Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

[Dr. Michael Geist]

Good afternoon, everybody. My name is Michael Geist. I'm a law professor at the University of Ottawa, where I hold the Canada research chair in internet and e-commerce law and am a member of the Centre for Law, Technology and Society.

My areas of speciality include digital policy, intellectual property and privacy. I served for many years on the Privacy Commissioner of Canada's external advisory board. I have been privileged to appear many times before committees on privacy issues, including on PIPEDA, Bill S-4, Bill C-13, the Privacy Act and this committee's review of social and media privacy. I'm also chair of Waterfront Toronto's digital strategy advisory panel, which is actively engaged in the smart city process in Toronto involving Sidewalk Labs. As always, I appear in a personal capacity as an independent academic representing only my own views.

This committee's study on government services and privacy provides an exceptional opportunity to tackle many of the challenges surrounding government services, privacy and technology today. Indeed, I believe what makes this issue so compelling is that it represents a confluence of public sector privacy law, private sector privacy law, data governance and emerging technologies. The Sidewalk Labs issue is a case in point. While it's not about federal government services—it's obviously a municipal project—the debates are fundamentally about the role of the private sector in the delivery of government services, the collection of public data and the oversight or engagement of governments at all levels. For example, the applicable law of that project remains still somewhat uncertain. Is it PIPEDA? Is it the provincial privacy law? Is it both? How do we grapple with some of these new challenges when even determining the applicable law is not a straightforward issue?

My core message today is that looking at government services and privacy requires more than just a narrow examination of what the federal government is doing to deliver the services, assessing the privacy implications and then identifying what rules or regulations could be amended or introduced to better facilitate services that both meet the needs of Canadians and provide them with the privacy and security safeguards they rightly expect.

I believe the government services really of tomorrow will engage a far more complex ecosystem that involves not just the conventional questions of the suitability of the Privacy Act in the digital age. Rather, given the overlap between public and private, between federal, provincial and municipal, and between domestic and foreign, we need a more holistic assessment that recognizes that service delivery in the digital age necessarily implicates more than just one law. These services will involve questions about sharing information across government or governments, the location of data storage, transfer of information across borders, and the use of information by governments and the private sector for data analytics, artificial intelligence and other uses.

In other words, we're talking about the Privacy Act, PIPEDA, trade agreements that feature data localization and data transfer rules, the GDPR, international treaties such as the forthcoming work at the WTO on e-commerce, community data trusts, open government policies, Crown copyright, private sector standards and emerging technologies. It's a complex, challenging and exciting space.

I would be happy to touch on many of those issues during questions, but in the interest of time I will do a slightly deeper dive into the Privacy Act. As this committee knows, that is the foundational statute for government collection and use of personal information. Multiple studies and successive federal privacy commissioners have tried to sound the alarm on the legislation that is viewed as outdated and inadequate. Canadians understandably expect that the privacy rules that govern the collection, use and disclosure of their personal information by the federal government will meet the highest standards. For decades we have failed to meet that standard. As pressure mounts for new uses of data collected by the federal government, the necessity of a “fit for purpose” law increases.

I would like to point to three issues in particular with the federal rules governing privacy and their implications. First is the reporting power. The failure to engage in meaningful Privacy Act reform may be attributable in part to the lack of public awareness of the law and its importance. Privacy commissioners played an important role in educating the public about PIPEDA and broader privacy concerns. The Privacy Act desperately needs a similar mandate for public education and research.

Moreover, the notion of limiting reporting to an annual report reflects really a bygone era. In our current 24-hour social media-driven news cycle, restrictions on the ability to disseminate information—real information, particularly that which touches on the privacy of millions of Canadians—can't be permitted to remain outside the public eye until an annual report can be tabled. Where the commissioner deems it in the public interest, the office must surely have the power to disclose in a timely manner.

Second is limiting collection. The committee has heard repeatedly that the Privacy Act falls woefully short in meeting the standards of a modern privacy act. Indeed, at a time when government is expected to be the model, it instead requires less of itself than it does of the private sector.

A key reform, in my view, is the limiting collection principle, a hallmark of private sector privacy law. The government should similarly be subject to collecting only that information that is strictly necessary for its programs and activities. This is particularly relevant with respect to emerging technologies and artificial intelligence.

The Office of the Privacy Commissioner of Canada, which I know is coming in later this week, recently reported on the use of data analytics and AI in delivering certain programs. The report cited several examples, including Immigration, Refugees and Citizenship Canada's temporary resident visa predictive analytics pilot project, which uses predictive analytics and automated decision-making as part of the visa approval process; the CBSA's use of advanced analytics in its national targeting program with passenger data involving air travellers arriving in Canada; and the Canada Revenue Agency's increasing use of analytics to sort, categorize and match taxpayer information against perceived indicators of risks of fraud.

These technologies obviously offer great potential, but they also may encourage greater collection, sharing and linkage of data. That requires robust privacy impact assessments and considerations of the privacy cost benefits.

Finally, we have data breaches and transparency. Breach disclosure legislation, as I'm sure you know, has become commonplace in the private sector privacy world and it has long been clear that similar disclosure requirements are needed within the Privacy Act. Despite its importance, it took more than a decade in Canada to pass and implement data breach disclosure rules for the private sector, and as long as that took, we're still waiting for the equivalent at the federal government level.

Again, as this committee knows, data indicate that hundreds of thousands of Canadians have been affected by breaches of their private information. The rate of reporting of those breaches remains low. If the public is to trust the safety and security of their personal information, there is a clear need for mandated breach disclosure rules within government.

Closely related to the issue of data breaches are broader rules and policies around transparency. In a sense, the policy objective is to foster public confidence in the collection, use and disclosure of their information by adopting transparent open approaches with respect to policy safeguards and identifying instances where we fall short.

Where there has been a recent emphasis on private sector transparency reporting, large Internet companies, such as Google and Twitter, have released transparency reports. They've been joined by some of Canada's leading communications companies such as Rogers and Telus. Remarkably, though, there are still some holdouts. For example, Bell, the largest player of all, still does not release a transparency report in 2019.

Those reports, though, still represent just one side of the story. Public awareness of the world of requests and disclosures would be even better informed if governments would also release transparency reports. These need not implicate active investigations, but there's little reason that government not be subject to the same kind of expectations on transparency as the private sector.

Ultimately, we need rules that foster public confidence in government services by ensuring there are adequate safeguards and transparency and reporting mechanisms to give the public the information it needs about the status of their data and appropriate levels of access so the benefits of government services can be maximized.

None of that is new. What may be new is that this needs to happen in an environment of changing technologies, global information flows and an increasingly blurry line between public and private in service delivery.

I look forward to your questions.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chair.

Ladies and gentlemen of the committee, thank you for the opportunity to appear before you to discuss the 2017-18 Main Estimates.

In the time allocated, I will first discuss the sustained demands on our office and the management of our financial resources. Secondly, I will talk about our policy agenda for this coming year.

In recent years, the Office of the Privacy Commissioner of Canada has maintained its efforts to find efficiencies and make optimal use of existing resources of slightly more than $24 million to be as effective as possible in addressing the privacy risks of an increasingly technological world.

Fiscal year 2017-18 will be no exception. Amidst competing demands, we will not lose sight of our mandate: ensuring that the privacy rights of Canadians are respected and that their personal information is protected.

In 2017-18, we will continue to fulfill our core mandate, which includes conducting investigations, examining breach reports, undertaking audits, reviewing privacy impact assessments or PIAs, providing guidance to individuals and organizations, and offering advice to parliamentarians.

On the investigations side, we have become more efficient in part through increased use of early resolution to find appropriate solutions. In 2015-16, 38% of complaints were resolved in this manner under the Privacy Act and 50% under the Personal Information Protection and Electronic Documents Act or PIPEDA. As a result, our response time on average was seven months for both public-sector and private-sector complaints.

However, the number of complex files is growing, which is creating a backlog of complaints that are not resolved after 12 months. In the coming year, I intend to devote temporary resources to address this situation.

In 2015-16, we received 88 new PIAs and completed 73 PIA reviews, in addition to opening 13 new consultation files. As you know, we would like to receive more PIAs and draft information sharing agreements, as we believe reviewing programs upstream is a good way to mitigate privacy risks.

In addition, we are taking steps to prepare for the coming into force of the breach provisions of Bill S-4. These new provisions will require private-sector organizations to report certain breaches to my office.

Public education and outreach are important activities to ensure Canadians are empowered to exercise their privacy rights and organizations are able to comply with their obligations. Last year, we revamped our website both in its structure and content to make it more user-friendly. This year, we will continue to update its content to provide helpful advice to Canadians.

We will continue to offer guidance to specific industry sectors deemed to be in need of greater privacy awareness, as well as vulnerable groups such as youth and seniors. We will also provide new guidance for individuals, and we will continue to advance our privacy priorities on issues such as online reputation, the body as personal information, the economics of personal information, and government surveillance.

Despite these efforts, we need to do much more to ensure that privacy rights are truly respected, a key condition for consumer trust and growth in the digital economy. Our goal is to complete all investigations within a reasonable time, to engage in some proactive enforcement, to give proactive advice to government, and to issue research-based guidance on most current and upcoming privacy issues.

In my annual report to be tabled in September, which will include our conclusions on improvements to the consent model and recommendations to amend PIPEDA, I will be able to bring more specificity to our compliance and proactive strategies. This, in turn, will inform a discussion on what might be an appropriate level of investment in OPC activities for the next few years.

I will now turn to some of the policy issues that we're seized with.

First is consent. Last May, my office released a discussion paper on issues related to privacy and consent. We then, through an extensive consultation process, sought input from industry, privacy experts, and Canadians. As mentioned, our final report will be released in September, and we will then work to implement the chosen solutions.

Second is online reputation. My office has also launched a consultation and call for submissions on the issue of online reputation as part of our efforts to address one of our strategic privacy priorities: reputation and privacy. We will share our policy position on online reputation before the end of the calendar year.

Third is legislative reform. My office has long stressed the need to modernize Canada's legal and regulatory frameworks. While the introduction of Bill S-4 was a positive development, Canada's federal private sector privacy law is now more than 15 years old. Technology and business models have changed. Our work on both consent and reputation will help inform the recommendations we will make to Parliament on reforming the law.

On the public sector side, I would like to express my gratitude to members of this committee for supporting my office's recommendations for modernizing the Privacy Act. My office now looks forward to participating in the government's review of the act to ensure that it meets the needs and expectations of Canadians, and in our view this work should proceed without delay.

On government surveillance, issues related to government surveillance will also form an important part of our policy agenda in the coming year. We note your recent report on SCISA, and we thank you for it. We also note the report just made public by SECU, the committee on national security, which also touched on information sharing under SCISA. We now await the measures the government will put forward to modify Bill C-51 to ensure that Canada's national security framework protects Canadians and their privacy.

We also have a number of investigations related to national security and government surveillance, and we are seeing heightened concerns from Canadians about privacy protections at the border and in the United States. Further to the adoption by President Trump of executive order 13768 of January 25, which deals with security in the interior of the United States, I had written to ministers to ask for confirmation that administrative agreements previously reached between Canada and the U.S. will continue to offer privacy protection to Canadians in the United States. Upon receipt of the government's response, which I expect shortly, I will inform Canadians of my conclusions.

In closing, to face the sustained volume but increased complexity of our work, we will continue this year to make the most efficient use of our resources as we have tried to do in the past.

Thank you, Mr. Chair. I look forward to questions from the committee.

[Dr. Michael Geist, Canada Research Chair in Internet and E-commerce Law, Professor of Law, University of Ottawa, As an Individual]

Thanks.

Good afternoon. My name is Michael Geist. I'm a law professor at the University of Ottawa where I hold the Canada research chair in Internet and e-commerce law. I appear here today in a personal capacity representing only my own views.

There's a lot that I would like to discuss given more time: stronger enforcement through order-making power; the potential for Canada's anti-spam legislation to serve as a model, at least on the issues of tougher enforcement and consent standards; and the mounting concerns with how copyright rules may undermine privacy. But given my limited time, I'll focus at least for these opening remarks on three issues: privacy reform pressures, consent, and transparency.

First, on the issue of reform, I had the honour of appearing before both the House and Senate committees on Bill S-4, which was ostensibly the effort to update PIPEDA by implementing recommendations that were first made in 2006. At the time it was obvious that further changes were needed. In fact, the ongoing delays in implementing even aspects of that bill, security breach notification, for example, shows how painfully slow the process of updating Canada's privacy laws has been.

I believe there's an increased urgency to address the issue. You've already heard from some and may hear from others about developments in Europe with the GDPR, which could threaten Canada's adequacy standing with European privacy officials.

But there's another international development that I think could have a significant impact on Canadian privacy law that bears attention. That's our trade deals and trade negotiations. The upcoming NAFTA renegotiations seem likely to include U.S. demands that Canada refrain from establishing so-called data localization rules that mandate the retention of personal information on computer servers located in Canada. Data localization has become an increasingly popular policy measure as countries respond to concerns about U.S.-based surveillance and the subordination of privacy protections for non-U.S. citizens and residents under the Trump administration.

Now, in response to those mounting concerns, leading technology companies like Microsoft, Amazon, and Google have established or committed to establish Canadian-based computer server facilities that can offer up localization of information. Those moves follow on the federal government's own 2016 cloud computing strategy that mandated that certain data be stored in Canada.

If we look at the Trans-Pacific Partnership, the TPP, we see that it included restrictions on the ability to implement data localization requirements at the insistence of U.S. negotiators. It seems likely that those same provisions will resurface during the NAFTA talks.

So too, I would argue, will limitations on data transfer restrictions which mandate the free flow of information on networks across borders. Those rules are unquestionably important to preserve online freedoms in countries that have a history of cracking down on Internet speech. But in a Canadian context they could restrict the ability to establish privacy safeguards. In fact, should the European Union mandate data transfer restrictions, as many experts expect, Canada could find itself between the proverbial privacy rock and a hard place, with the European Union requiring restrictions and NAFTA prohibiting them.

Secondly, I want to focus on consent. As you know, privacy laws around the world differ on many issues, but they all share a common principle: collection, use, and disclosure of personal information requires user consent, an issue that has become increasingly challenged in a digital world where data is continuously collected and can be used for a myriad of previously unimaginable ways.

Now, rather than weakening or abandoning consent models, I believe the Canadian law needs to upgrade its approach by making consent more effective in the digital environment. There's little doubt that the current model is still too reliant on opt-out policies in which businesses are entitled to presume that they can use their customers' personal information unless those customers inform them otherwise. Moreover, cryptic privacy policies often leave the public confused about the information that may be collected or disclosed, creating a notion of consent that is largely fiction not fact.

How can we solve some of the problems with the current consent-based model? I'd identify at least four proposals. First, we should implement an opt-in consent approach as the default approach. At the moment, opt-in is only used where strictly required by law or for highly sensitive information, such as health or financial data. That means that the vast majority of information is collected, used, and disclosed without informed consent.

Second, since informed consent depends upon the public understanding how their information will be collected, used, and disclosed, the rules associated with transparency must be improved. The use of confusing negative-option check boxes that leave the public unsure about how to exercise their privacy rights should be rejected as an appropriate form of consent. They never know if they should be clicking or unclicking a box to protect their privacy.

Moreover, given the uncertainty associated with big data and cross-border data transfers, new forms of transparency and privacy policies are needed. For example, algorithmic transparency would require search engines and social media companies to disclose how information is used to determine the content displayed to each user. Data transfer transparency would require companies to disclose where personal information is stored and when it may be transferred outside of the country.

Third, effective consent means giving users the ability to exercise their privacy choices. Most policies are offered on a “take it or leave it” basis, with little room to customize how information is collected, used, and disclosed. Real consent should mean real choice.

Fourth, stronger enforcement powers are needed to address privacy violations. The rush that we saw in Canada to comply with Canada's anti-spam laws was driven by the inclusion of significant penalties for violation of the rules. Canadian privacy law today is still premised largely on moral suasion or fear of public shaming, not tough enforcement backed by penalties. If we want the privacy rules to be taken seriously, there must be serious consequences when companies run afoul of the law.

Finally, I'll say a word on transparency and reporting. As many of you will know, in recent years, the stunning revelations about requests and disclosures of the personal information of Canadians—millions of requests, the majority without court oversight or warrant—point to an enormously troubling weakness in Canada's privacy laws. Simply put, most Canadians have no awareness of these disclosures and are shocked to learn how frequently they occur.

There's been a recent emphasis on private sector transparency reporting. Large Internet companies such as Google and Twitter have released transparency reports. Twitter released their 10th annual report today, and they've been joined by some of Canada's leading communications companies, such as Rogers and Telus.

Despite the availability of a transparency reporting standard that was approved by the government and the Privacy Commissioner, there are still some holdouts. The problem lies with the non-binding approach with respect to transparency disclosures.

I obtained some information under the Access to Information Act, and learned that after an industry-wide meeting organized by the Privacy Commissioner in April 2015, Rogers noted the following:

It was indicated at this meeting that any guidelines adopted would fall short of regulation, but would be regarded as more substantive than voluntary guidelines.

Yet, if the non-regulatory approach does not work, it falls to either the federal Privacy Commissioner or the government to take action.

The most notable company to refrain from meeting these transparency standards is Bell Canada, Canada's largest telecommunications company. Bell initially claimed that it was waiting for a standard from the Privacy Commissioner, but now, almost a year after that standard has been released, they still have not released the transparency report. Millions of Canadians still don't know when, under what circumstances, and with what frequency Bell discloses their subscriber information. In my view, that's simply unacceptable.

If the current law doesn't mandate such disclosures there is a problem with the law, and reform requiring transparency disclosures with real penalties for failure to do so is needed. I don't need to tell you that scarcely a day goes by without some media coverage of a privacy-related issue. I think it is clear that the public is concerned with their privacy, and it is also clear that the business community has come to recognize the value of personal information. It is time for the law to catch up.

I look forward to your questions.

[Vincent Gogolek]

Federally, we would be looking for something stronger than what's currently in PIPEDA, but of course there is breach notification right now as a result of Bill S-4 from the last Parliament.

[Daniel Therrien]

That's part of Bill S-4, which will come into force soon.

[Drew McArthur]

In a recent presentation I made I highlighted some of the shifts in moving from being regulated to being a regulator. It's been an interesting learning curve for me and I've become more sensitive to some of the issues.

Specifically I'll talk about mandatory breach notification. When I was in the private sector, we worked very hard to come up with voluntary breach notification guidelines, and we worked with the privacy commissioners across the country to implement those as guidelines for organizations. I now see those embodied in the federal privacy legislation, Bill S-4. When the regulations are implemented, we will see that for federal private sector organizations. We see it in Alberta, and we've recommended it in B.C., and the B.C. government has accepted that.

What was once voluntary in the private sector is now becoming de facto standard of being mandatory. We also note that in Europe the general data protection authority has come out to indicate that mandatory breach notification is required. I'll also note that they've taken a few steps further than that, and it's going to be significant for Canada to continue to be substantially similar with the requirements of GDPR for the free flow of information as it relates in the private sector for organizations that operate multinationally.

[Drew McArthur]

Thank you very much for the invitation.

My office provides independent oversight and enforcement over B.C.'s access and privacy laws. The enforcement and oversight extends to over 2,900 public bodies, including ministries, local governments, schools, crown corporations, hospitals, municipal police forces, and more. They're subject to B.C.'s public sector privacy law, the Freedom of Information and Protection of Privacy Act or FIPPA.

It extends to over 380,000 private sector organizations, including businesses, charities, associations, trade unions, trusts, and more that are subject to B.C.'s Personal Information Protection Act or PIPA.

Today I am going to focus my comments on three areas that are part of the deliberations of this committee to which the B.C. experience may be informative: commissioners order-making powers, an explicit obligation to safeguard personal information, and mandatory breach notification. Under order-making power and mediation and consultation, in British Columbia the mandate of the office includes the promotion of access and privacy rights, public education, advice to public bodies and businesses, investigation of complaints, mediation, and independent adjudication. These functions are complementary, and in my opinion, best delivered under one roof. It would be extremely difficult for another administrative tribunal or court to attain the same level of expertise and provide for efficient and timely resolutions for citizens.

Privacy and access to information issues are dynamic in the modern digital world. It's in the interests of organizations, individuals, and public bodies that the individuals making legal and binding decisions have the requisite skills and up-to-date knowledge about what is happening on the ground. Having the responsibility for adjudication plus advocacy, education, and investigation ensures the necessary expertise in the law. Our adjudicators receive the same technical training and professional development as our investigators, and are routinely exposed to new technologies, emerging ideas, and global trends affecting privacy and access to information law.

Combining the investigation and adjudication into one office provides clear benefits to citizens. Combining those provides one-stop shopping for citizens. This clarity and convenience is important. There is no confusion about which oversight agency or tribunal citizens need to direct their complaint to. They need merely to address our office. Citizens don't feel as though they are caught in or bounced around an unnecessarily bureaucratic system.

We have not found that the public education or the advisory functions of a commissioner pose a risk of undermining the adjudicative function. We do take steps to protect the integrity of the adjudication process. For example, no information about investigative files or attempts at informal resolution are ever disclosed to the adjudicators. The adjudicators do not report to the same supervisor, and they are not located on the same floor as the investigators.

When providing the public with advice and consultation, we clarify that our view is based on the information provided at the time, and that it is not binding on the commissioner with respect to making a formal finding in the event that we receive a future complaint.

In our consultations, we communicate about general principles and recommend best practices without prejudging individual cases. We are able to perform these various roles effectively because our legislation also explicitly gives us these powers and spells them out in detail.

Adjudication enhances our ability to resolve issues through mediation. The adjudicative function lends greater authority to our investigators by focusing the minds of the parties, and it provides an incentive to both parties to avoid formal adjudication. As a result, we resolve 90% of our complaints and reviews in mediation. In the last year we had 1,056 complaints and requests for review, of which only 109 went to inquiry. Of those that went to inquiry, only a little over 1% were judicially reviewed.

The fact that we have public education and advisory functions, complemented by investigative powers, with the ultimate ability to order compliance through our adjudicative function, gives us a level of authority that can influence the public and the government. Without that complete suite of functions, we would not have that same level of influence.

B.C.'s public sector privacy law has an explicit requirement for public bodies to safeguard personal information. We consider this legislative requirement as being fundamental to a public body's responsibility for the personal information it collects from citizens. Given the negative repercussions that can occur to citizens in the event of a breach of their personal information, it's almost unbelievable that a privacy protection statute would not incorporate this requirement.

Section 30 of our act states:

a public body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.

Citizens rely on this section and expect that a public body is taking adequate measures to protect their personal information. It's the legislative requirement in most jurisdictions across Canada and internationally. Having this requirement in legislation is important from the perspective of public trust, as a clear and binding requirement on public bodies. It indicates the importance that governments place on this requirement.

While B.C.'s legislation does not explicitly address physical, organizational, and technological measures commensurate with the sensitivity of the data, our office has set out similar expectations in investigation reports and orders. In my view, placing this language explicitly in the legislation would be consistent with international standards regarding the protection of personal information.

Also, we have been clear that, as our province's regulator, we evaluate “reasonable security arrangements” on an objective basis, and that the determination of what is reasonable is contextual. The standard is not one of perfection but varies based on the sensitivity and the amount of personal information in question.

On breach notification, a privacy breach occurs when there is unauthorized access, collection, use, or disclosure of personal information. It is unauthorized if it occurs in contravention of one of our privacy laws. An important element of safeguarding personal information is ensuring that the privacy commissioner and affected individuals are notified when a privacy breach occurs.

Privacy breaches can carry significant costs. They put individuals at risk for identity theft and serious financial or reputational harms. They can also result in a loss of dignity and a loss of confidence in public bodies. We trust public bodies with some of our most sensitive and comprehensive personal information: social security records, tax data, health information, financial information, and the list goes on. We have no choice but to provide that information to the public bodies.

It seems every week that privacy breaches are reported in the media. We hear about laptops and portable storage devices being lost or stolen, human error resulting in disclosure, unauthorized access, or snooping as well as cyber-attacks.

Breach reporting in B.C. is currently voluntary in both the private and public sector. However, my office has recommended that it be made a mandatory requirement, and let me explain why. In British Columbia, we examined the government's privacy breach management process and we published those results in 2015. We learned that nearly 3,000 breaches were reported to government during the period of 2010 to 2013, but only 30 of those had been reported to my office. This told us that, under a voluntary reporting requirement, my office was receiving reports of only about 1% of all the breaches that occur within government ministries. Of those, the majority, 72%, were classified as “administrative errors”. The breakdown of other types of breaches included unauthorized disclosures at 16%, lost or stolen at 4%, unauthorized access at 3%, and cyber-attacks or phishing at less than 1%.

It shows that it's important to set out a clear threshold where notification must occur. We don't want to hear about every breach, but we need to know about the important ones. In B.C., we have recommended that the threshold be where the breach would be reasonably expected to cause harm to an individual, or where the breach involves a large number of individuals.

Mandatory breach reporting to a privacy commissioner also means that the commissioner's office can work with public bodies to learn from their mistakes and implement lasting preventative strategies. Mandatory breach notification also ensures that affected individuals are made aware of breaches without unreasonable delay, so they can take the important steps to protect themselves.

For these reasons, my office has recommended to the legislative committees reviewing B.C.'s privacy statutes that mandatory breach notification be added as a requirement. Both of these committees agreed and recommended in their final reports that the privacy laws for the public and the private sectors be amended to require breach notification to the commissioner and to affected individuals in the event of a privacy breach. The B.C. government has stated that it is committed to addressing mandatory breach notification at the next available legislative opportunity.

The federal Bill S-4 added breach notification requirements to Canada's private sector privacy law, and it is difficult for me to understand why the government would not hold itself to the same standard as it holds the private sector.

That concludes my remarks.

[Dr. Michael Geist, Canada Research Chair in Internet and E-commerce Law and Professor of Law, University of Ottawa, As an Individual]

Thank you.

Good morning, everyone. As you heard, my name is Michael Geist. I am a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law.

My areas of specialty are digital policy, intellectual property, and privacy. I served for many years on the Privacy Commissioner of Canada's external advisory board, and I have been privileged to appear before many committees on privacy issues, including things such as PIPEDA, Bill S-4, Bill C-13, the Privacy Act, and this committee's earlier review a number of years ago on social media and privacy.

I appear today though, as always, in a personal capacity representing only my own views. As you know, there is a sense of déjà vu when it comes to Privacy Act reviews. We have had many studies and successive federal privacy commissioners who have tried to sound the alarm on legislation that is viewed, as you just heard, as outdated and inadequate. I think that Canadians rightly expect that the privacy rules that govern the collection, use, and disclosure of information by and within the federal government will meet the highest standards, and for decades we have failed to meet that standard.

I would like to quickly touch on some Privacy Act concerns, but with your indulgence I'll talk a bit about some of the other broader privacy law environment issues in Canada that I think are really directly related to the Privacy Act.

First though, on the Privacy Act—and this is going to sound familiar as I have flagged some of the same issues that David did—I think the Privacy Commissioner of Canada has provided this committee with many very good recommendations, and I endorse the submission. As you know, most of those recommendations are not new. Successive commissioners have asked for largely the same changes, and successive governments of all parties have failed to act.

I want to highlight four issues in particular with respect to the current law, and as I say, David has flagged some of them already. The first is education and the ability to respond. The failure to engage in meaningful Privacy Act reform may be attributable, at least in part, to the lack of public awareness of the law and its importance. I think the Privacy Commissioner plays an important role in educating the public, and has done so on PIPEDA and broader privacy issues. The Privacy Act really needs a similar mandate for public education and research. Moreover—and you just heard this—the notion of limited reporting through an annual report, I think, reflects a bygone era. In our current 24-hour, social-media-driven news cycle, restrictions on the ability to disseminate information, particularly information that can touch on the privacy of millions of Canadians, can't be permitted to remain outside of the public eye and left for annual reports when they are tabled. Where the commissioner deems doing so to be in the public interest, the office must surely have the power to disclose in a timely manner.

I also think we need to think about strengthening protections. As you've heard, the Privacy Act falls woefully short of meeting the standards of a modern privacy act. Indeed, at a time when government is expected to be a model, it instead requires far less of itself than it does of the private sector. A key reform, in my view, is the principle of limiting collection, a hallmark of private sector privacy law. The government should similarly be subject to collecting only that information that is strictly necessary for its programs and activities.

I'd also flag, as David did, breach disclosure, which has been commonplace in the private sector privacy world, and it has long been clear that similar disclosure requirements are needed within the Privacy Act. The Treasury Board guidelines are a start, but legal rules, in my view, are essential. In fact, the need for reform is even stronger given the absence of clear security standards within the act. Provisions that establish such standards and mandate disclosure in the event of a breach are crucial to establishing an appropriate level of accountability and ensuring that Canadians can guard against potential identity theft and other harms.

The final issue is privacy impact assessments. As you all know, privacy touches us in many ways, and it similarly is implicated in many pieces of legislation. I recall that during the last session of Parliament, the Privacy Commissioner regularly appeared before committees to provide a privacy perspective on many different pieces of legislation. This approach of coming in after the legislation has been drafted at the committee, I think, runs the risk of rendering privacy as little more than just an afterthought. It's more appropriate to conduct a privacy impact assessment before legislation is tabled, or, at a minimum, at least before it's implemented.

Those are some of the issues on the Privacy Act side, but as I said, I wanted to talk about three bigger picture issues that I think are some of the moving parts in the federal privacy world.

The first has to do with Bill C-51's information-sharing provisions. I realize the government is currently consulting on national security policy, and there's, as you know, a particular emphasis on Bill C-51. From my perspective, one of the biggest problems was the information-sharing provisions. The privacy-related concerns stem from an act within the act in Bill C-51's Security of Canada Information Sharing Act. As you may know, the sharing of information went far beyond information related to terrorist activity.

It permits information sharing across government for an incredibly wide range of purposes, most of which have little to do with terrorism. The previous government tried to justify the provisions on the grounds that Canadians would support sharing of information for national security purposes, but the law now allows sharing for reasons that I think would surprise and disturb many Canadians, given how broadly those provisions can be interpreted.

Further, the scope of sharing is very broad, covering 17 government institutions, many of which are only tangentially related, if at all, to national security. The background paper on the national security consultation raises the issue, but in my view appears to largely defend the status quo, raising only the possibility, it seems to me, of tinkering with some clarifying language. If we don't address the information-sharing issue, I fear that many of the potential Privacy Act improvements will be undermined. I think this requires a wholesale re-examination of information sharing within government and the safeguards that are there to prevent misuse.

Second, I want to talk about transparency and reporting from a slightly different perspective. As many of you may know, in recent years, there have been stunning revelations about requests and disclosure of personal information of millions of Canadians, millions of requests, the majority of which are without court oversight or warrant, which I think points to a real weakness within Canada's privacy laws. Most Canadians have no awareness of these disclosures and have been shocked to learn how frequently they are used.

Recent emphasis has been on private sector transparency reporting. Large Internet companies such as Google and Twitter have released transparency reports, and they have been joined by some of Canada's leading communications companies such as Rogers and Telus. There are still some holdouts, notably Bell, but we have a better picture of requests and disclosures than we did before. However, these reports represent just one side of the picture. Public awareness of requests and disclosures would be far more informed if government also released transparency reports. These need not implicate active investigations, but there is little reason for government to not be subject to the same expectations on transparency as we expect of the private sector. Indeed, the Liberal Party focused on transparency in its election platform. Improvements to access to information are absolutely critical, but transparency is about more than just opening the doors to requests for information. Proactive disclosure of requests for Canadians' information should be part of the same equation.

Third and finally, I want to talk briefly about government-mandated interception capabilities and decryption. The public safety consultation that I referenced, which was launched earlier this month, has been largely characterized as a C-51 consultation, but it's much more. The return of lawful access issues threatens to scrap the 2014 lawful access compromise, and I think raises some really serious privacy concerns.

For instance, the consultation implies that “lack of consistent and reliable technical intercept capability on domestic telecommunication networks” represents a risk to law enforcement investigations. Yet left unsaid is that the prior proposed solutions in the form of government-mandated interception capabilities for telecommunications companies were rejected due to the enormous cost, inconsistent implementation, and likely ineffectiveness of standards that would exempt many smaller providers. Creating government-mandated interception capabilities for all providers represents an enormous privacy risk that I think runs roughshod over both PIPEDA and the Privacy Act.

Further, the consultation places another controversial policy issue on the table, noting that encryption technologies are “vital to cybersecurity, e-commerce, data and intellectual property protection, and the commercial interests of the communications industry”, but lamenting that some of those same technologies can be used by criminals and terrorists.

Given its widespread use and commercial importance, few countries have imposed decryption requirements. This year's controversy involving access to data on an Apple iPhone that was owned by the San Bernardino, California, shooter revived debate over access to encrypted communications. The consultation asks Canadians to comment on circumstances under which law enforcement should be permitted to compel decryption. A move toward compelling decryption, in my view, would place more than just our privacy at risk. It would also place our innovation strategy and personal security in the balance.

In conclusion, fixing the Privacy Act is long overdue. There is little mystery about what needs to be done. Indeed, there have been numerous studies and a steady stream of privacy commissioners who have identified the problems and called for reform. What has been missing is not a lack of information, but rather, with all respect, a lack of political will to hold government to the same standard that it holds others.

I look forward to your questions.

[David Fraser, Partner, McInnes Cooper, As an Individual]

Thank you very much.

Thank you for the opportunity to speak about this statute, which is one of the most important statutes we have to regulate the interaction between individual citizens and their government.

The Privacy Act was great for the 1980s, but much has changed since then. This committee has heard a lot about changes in technology, but I think one overarching consideration is changes in people's expectations. We have seen developed, in a number of different jurisdictions across Canada, much more modern privacy laws. We have the Personal Information Protection and Electronic Documents Act, which regulates the private sector and is based on fair information practices. I believe this committee has also heard a lot about the new ATIPPA statute in Newfoundland. You had the benefit of speaking to the committee responsible for the report that led to its complete revamp.

One thing worth noting, when you are looking at this statute compared with other more modern privacy statutes, is that consent generally does not work in the government context. Individual citizens don't choose, for example, the government with which they deal, compared with choosing which bank they go to, and things like that.

One thing I want to emphasize, first and foremost, is that I have had the opportunity to review and actually contribute to the Canadian Bar Association's submissions over the years. Although I am speaking in my own capacity, I generally agree with everything that's in there. Also, I am in general agreement with what has been noted and asked for in the Privacy Commissioner's submissions to this committee over the course of a number of years. There are a couple of things I would like to specifically highlight that I think are important to look at.

One is what could be a basic technical fix, which is to remove the requirement that personal information be recorded in order to be subject to the statute. Information that is just stated orally, that is handed over.... The statute can be interpreted such that the disclosure of information orally is not captured within the statute, and that is a significant gap.

I also think that there should be a provision in the statute to clarify that the work product of public servants should not be considered to be personal information of those public servants. This statute should work hand in hand with the Access to Information Act to encourage transparency of government operations. Unwarranted calls for privacy standing up in the face of government transparency are problematic and something that can be quite easily addressed.

The rest of my recommendations or suggestions would probably be lumped in under three different categories: accountability, transparency, and overall making the statute effective.

Under the accountability banner, I would think that we need more clarity, as citizens, about how government manages the personal information of its citizens. We have the personal information banks and info source systems, which I don't think are entirely effective. There needs to be more proactive disclosure to citizens about how their information is used, who is responsible for it, and which government department is using it.

There should also be a necessity test, which is something this committee has heard about, with respect to the collection of personal information. The government institution should collect only information that is necessary for its functioning activities.

I think there should also be an element of personal accountability within the statute, which is missing. Many more modern privacy laws, particularly health privacy laws but also others across the country, have an offence provision that if an individual or even an institution, unlawfully and usually with knowledge, is in violation of the statute, they can be charged under that. We have seen a large number of privacy breaches across the country related to individuals just browsing through large databases for their own entertainment, and charges being brought against those individuals in various provinces. I think that's something that should be introduced into the Privacy Act.

Under the heading of transparency, fair information practices are generally based on notice and consent. As I said, consent isn't something that generally works in the public sector context, but I do think that there needs to be more proactive communication to citizens about what the information is going to be used for in order to justify its collection. Other jurisdictions regularly include privacy notices on the forms that they require citizens to complete, letting them know and setting their expectations with respect to why the information is necessary, how it is going to be used, who is going to be the custodian of that information, and how they can get access to it and have it corrected, if necessary, to exercise their other rights under the statute.

Also in connection with transparency, I think that the Privacy Act should specifically give the commissioner an education mandate, but along with that it should also give the commissioner the ability to publish reports of findings of investigations under the Privacy Act.

Currently the commissioner publishes such findings for private sector investigations, but we need more guidance. Transparency about what the government is doing with respect to personal information would be significantly served if there were such an obligation, or at least the mandate and the ability for the commissioner to report findings. In the annual report that the commissioner issues each year, there are summaries of some notable cases, but I think we would all benefit from understanding what government departments are doing with people's personal information. Having that information out there, particularly if it's found that the government department has not acted properly, would serve a significant education mandate for all government departments, but also for citizens generally.

I do think we need to have breach notification if there's a breach of security safeguards, similar to what was added to PIPEDA in the Digital Privacy Act, an obligation on the part of the government institution to notify both the Privacy Commissioner and notify affected individuals if a proper threshold has been met. I think the one in the Digital Privacy Act is a reasonable one.

Then ultimately, there's making it effective. I'm not a fan of order-making powers. I think the ombuds model works, but I have come around to see the wisdom of the Newfoundland hybrid model, where if a government department is not going to follow a recommendation with respect to any obligation under the Privacy Act—collection, use, disclosure, or other safeguards—the department should have to stand up in front of a court and justify it and explain why it doesn't have to. In effect, that puts the onus on the government department, and we would end up with a body of case law that would be more clear. That could be by an expedited application process, which is already the procedure under PIPEDA, so that these don't turn into significant, huge federal cases.

Those are the highlights of my recommendations for the statute. It is really outdated, really antiquated, and I don't think it accords with the evolved expectations of individuals about how their information is going to be collected, used, and disclosed. We shouldn't tolerate a quasi-constitutional statute that's at least two generations out of date.

Thank you very much.

[Daniel Therrien]

The notice that we currently receive voluntarily, which will be mandatory once Bill S-4 comes into force, comes into our PIPEDA investigation group. There is one person who receives these notices. In the notice from the organization, the company describes certain facts and tries to assess the impact. We review that. We give advice to the company.

When the case is particularly of concern, as we have seen in some cases, we can actually start an investigation, which is in the broader group of investigators within the PIPEDA group.

The vast majority of breaches will lead simply to reading the report given to us by the company in question and giving advice—or not, depending on the situation. In a minority of cases, a full investigation will occur.

[Raj Saini, Liberal, Kitchener Centre, ON]

Now with Bill S-4, you are going to have more reporting, breach reporting, that will come from the private sector.

Just for those of us who are not well-informed of the protocol, just so we understand where the resources should be allocated, can you give us a very brief overview of the way a breach flows thorough the system once it is reported, so we know what components are involved in assessing that breach?

[Daniel Therrien]

Sure. I would start with the fact that very few of these cases lead to court action. I'll distinguish between the public and the private sector again.

Under the public sector rules, there is now a directive from the Treasury Board that mandates departments to notify my office and the Treasury Board when there is a significant or material breach in a department. We've not been funded to do that work, so we had to reallocate from other places. Essentially there is one person in the office who deals with these cases.

We receive reports from departments. In the public sector there are roughly 300 of these breach notifications every year. There is one person to review these reports at the office. We look at what the department tells us in terms of the nature and the potential impact of the breach. We give some advice, but with few resources the examination is relatively superficial.

On the private sector side, there is no obligation at this point for companies to notify us. Some companies notify us voluntarily. Under Bill S-4, which was adopted by Parliament last year, when regulations are adopted, there will be a legal obligation for companies to notify us, but again, there will be no funding. We're talking about hundreds of notifications per year given to our office. We have one person on the public sector side and one on the private sector side to look at these. By necessity we review fairly superficially what the departments tell us or what the companies tell us.

To add to this, as you know, there are other statistics out there that suggest there are many more breaches than those our office is actually notified about.

I think the issue of breaches is a significant problem. We do what we can with these two people who are devoted to these analyses. Given the importance of the issue of breaches, it's a concern for me that we have as few resources as we do to devote to these issues.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

My understanding is that with Bill S-4 you'll be anticipating an increase in the number of investigations relating to the private sector. Is that right?

[The Speaker, Conservative, Andrew Scheer]

I have the honour to inform the House that when the House did attend His Excellency the Governor General in the Senate Chamber, His Excellency was pleased to give, in Her Majesty's name, the royal assent to the following bills:

Bill C-247, An Act to expand the mandate of Service Canada in respect of the death of a Canadian citizen or Canadian resident—Chapter 15.

Bill C-452, An Act to amend the Criminal Code (exploitation and trafficking in persons)—Chapter 16.

Bill C-591, An Act to amend the Canada Pension Plan and the Old Age Security Act (pension and benefits)—Chapter 17.

Bill S-3, An Act to amend the Coastal Fisheries Protection Act—Chapter 18.

Bill S-6, An Act to amend the Yukon Environmental and Socio-economic Assessment Act and the Nunavut Waters and Nunavut Surface Rights Tribunal Act—Chapter 19.

Bill C-51, An Act to enact the Security of Canada Information Sharing Act and the Secure Air Travel Act, to amend the Criminal Code, the Canadian Security Intelligence Service Act and the Immigration and Refugee Protection Act and to make related and consequential amendments to other Acts—Chapter 20.

Bill C-46, An Act to amend the National Energy Board Act and the Canada Oil and Gas Operations Act—Chapter 21.

Bill C-2, An Act to amend the Controlled Drugs and Substances Act,—Chapter 22.

Bill C-26, An Act to amend the Criminal Code, the Canada Evidence Act and the Sex Offender Information Registration Act, to enact the High Risk Child Sex Offender Database Act and to make consequential amendments to other Acts—Chapter 23.

Bill C-63, An Act to give effect to the Déline Final Self-Government Agreement and to make consequential and related amendments to other Acts—Chapter 24.

Bill C-66, An Act for granting to Her Majesty certain sums of money for the federal public administration for the financial year ending March 31, 2016—Chapter 25.

Bill C-67, An Act for granting to Her Majesty certain sums of money for the federal public administration for the financial year ending March 31, 2016—Chapter 26.

Bill C-42, An Act to amend the Firearms Act and the Criminal Code and to make a related amendment and a consequential amendment to other Acts—Chapter 27.

Bill C-555, An Act respecting the Marine Mammal Regulations (seal fishery observation licence)—Chapter 28.

Bill S-7, An Act to amend the Immigration and Refugee Protection Act, the Civil Marriage Act and the Criminal Code and to make consequential amendments to other Acts—Chapter 29.

Bill C-12, An Act to amend the Corrections and Conditional Release Act—Chapter 30.

Bill C-52, An Act to amend the Canada Transportation Act and the Railway Safety Act—Chapter 31.

Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act—Chapter 32.

Bill S-2, An Act to amend the Statutory Instruments Act and to make consequential amendments to the Statutory Instruments Regulations—Chapter 33.

Digital Privacy Act

[The Speaker, Conservative, Andrew Scheer]

Pursuant to an order made on Wednesday, June 17, the House will now proceed to the taking of the deferred recorded division on the amendment of the member for Victoria on the motion at third reading of Bill S-4.

Call in the members.

The House resumed from June 17 consideration of the motion that Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, be read the third time and passed, and of the amendment.

[The Deputy Speaker, NDP, Joe Comartin]

It being 6:30 p.m., pursuant to an order made earlier today, all questions necessary to dispose of the motion for third reading of Bill S-4 are deemed put and the recorded division is deemed to have been demanded and deferred until Thursday, June 18, at the expiry of the time provided for oral questions.

The hon. Parliamentary Secretary to the Minister of Public Works and Government Services.

[Colin Carrie, Conservative, Oshawa, ON]

Mr. Speaker, unfortunately, as lawmakers we know from experience that there will always be those who will break the rules. That is why Bill S-4 would make important improvements to PIPEDA's compliance framework. These changes would ensure the commissioner has the necessary tools to ensure organizations respect the law and protect the privacy of Canadians.

The digital privacy act would set out serious consequences for any organization that deliberately ignores its data breach obligations and intentionally attempts to cover up a data breach. Bill S-4 would make it an offence for any organization to deliberately fail to notify individuals, report to the commissioner, or keep the necessary records.

In these cases of deliberate wrongdoing, an organization could face fines of up to $100,000 per offence. I want to ensure this point is very clear. It would be a separate offence for every single person and organization that is deliberately not notified of a potentially harmful data breach, and each offence would be subject to a maximum $100,000 fine.

These changes are widely supported by stakeholders, as evidenced by witness testimony during the committee's review of the bill. Professor Michael Geist stated:

These disclosure requirements are long overdue as I think it creates incentives for organizations to better protect their information and allows Canadians to take action to avoid risks such as identity theft. There are aspects in this bill that are an improvement over the prior bills, Bill C-12 and Bill C-29, most notably the inclusion of actual penalties that are essential to create the necessary incentive for compliance.

At committee, the Canadian Internet Policy and Public Interest Clinic stated:

We're very grateful to see a penalty regime for instances where the breach notification obligations are knowingly ignored...The fines currently in PIPEDA are designed as penalties for very overt offences.

The list continues. The Canadian Bankers Association stated:

We also support the commissioner's new oversight powers to ensure that organizations comply with these new provisions.

The Canadian Life and Health Insurance Association Inc. was also supportive. It stated that the bill takes a balanced approach to the responsibilities placed on business and organizations, but most importantly, it will protect the consumer of those businesses, and gives individuals the information they need to take corrective action when it is necessary.

The digital privacy act does indeed take a balanced approach, one that avoids the over-reporting of harmless incidents while ensuring that the commissioner has the necessary tools to oversee whether organizations are meeting their obligations under Bill S-4.

This balanced approach would also ensure that punishment is reserved for the most egregious offenders, those who knowingly and deliberately try to circumvent the law. Those organizations caught making a mistake in good faith would instead work with the Privacy Commissioner under the existing dispute resolution tools in the act.

Our government recognizes that many organizations already notify individuals of data breaches in a responsible manner.

Let me be very clear. The penalties in the digital privacy act would target the bad apples, those organizations that willfully and knowingly disregard their obligations or, worse, cover up a breach.

The digital privacy act would encourage all organizations to play by the same rules. It would provide incentives to comply with the new data breach obligations, and also to implement appropriate data security practices to prevent breaches from happening in the first place.

By requiring organizations to keep records of their data breaches and by enforcing the requirements with stiff penalties, these amendments would increase the accountability of organizations to maintain good privacy practices and would provide the Privacy Commissioner with the tools he needs to enforce these protections.

I urge hon. members to join with me in supporting the bill.

The House resumed consideration of the motion that Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, be read the third time and passed, and of the amendment.

[Colin Carrie, Conservative, Parliamentary Secretary to the Minister of the Environment]

Mr. Speaker, I will be sharing my time with the member for Kelowna—Lake Country. I appreciate the timeline on this.

I am pleased to rise in my place today to speak to Bill S-4, the digital privacy act, which would make a number of important changes to strengthen Canada's private sector privacy law, the Personal Information Protection and Electronics Documents Act, or what is more commonly known as PIPEDA.

Data breaches are very concerning to Canadians. In fact, a recent survey conducted by the Office of the Privacy Commissioner in 2014 found that news of data breaches among several large retailers had made 80% of Canadians more reluctant to share their personal information with businesses. This is simply unacceptable. Canadians needs to know that when they choose to share their personal information with a business, it will be protected and kept confidential.

The proposals in Bill S-4 will amend PIPEDA to significantly strengthen the current law and ensure that the privacy of Canadians will be protected when it comes to the rules that companies must abide by when they collect, use or disclose personal information in the course of commercial activities. In the current legislation, there is no legal obligation for businesses and organizations to tell customers and clients when their personal information has been lost or stolen.

The digital privacy act would correct this by making important changes to PIPEDA and implement new data breach requirements for businesses. These changes would ensure that organizations would be taking appropriate steps to notify Canadians. The requirement for mandatory notification is welcome by many stakeholders, in particular the Privacy Commissioner of Canada. In his recent annual report to Parliament on PIPEDA, he stated:

—we welcome the proposed amendment to PIPEDA in Bill S-4, the Digital Privacy Act, which seeks to implement mandatory breach notification.

He went on to say:

Mandatory notification will also provide a clearer picture of the frequency and type of data breaches experienced by organizations.

Mandatory notification would better inform Canadians of situations in which their personal information has been compromised. It would also enable Canada to keep pace with other jurisdictions where similar measures have been enacted or are being considered.

As we have discussed many times, strong rules are meaningless if they are not backed up with strong compliance tools. Bill S-4 would give the Privacy Commissioner of Canada the necessary tools to hold companies accountable when it comes to the protection of the personal information of Canadians.

In addition to the notification provisions, Bill S-4 would also require organizations to keep a record of the event, regardless of whether a breach posed a risk of harm. These records would not only allow organizations to demonstrate due diligence in the risk assessment, but would also require companies to keep track of when their data security safeguards fail so they could determine whether they have a systemic problem that would need to be corrected. What is more, organizations will be required to provide these records to the commissioner upon request at any time.

This record-keeping requirement will give the Privacy Commissioner the appropriate tools to hold organizations accountable for their obligation to report serious data breaches. Once again, I would like to quote the Privacy Commissioner's 2014 annual report, where he stated:

—requiring organizations to keep and maintain a record of breaches, and provide us with such information upon request would be an important accountability mechanism. Our Office would be able to evaluate compliance with the notification provisions and assess how organizations are deciding whether—

[Ted Hsu, Liberal, Kingston and the Islands, ON]

Mr. Speaker, it is an honour to speak to Bill S-4, legislation which amends the Personal Information Protection and Electronic Documents Act.

As our lives are more and more immersed in a digital world, our understanding of digital privacy changes and our means of protecting digital privacy also needs to be updated. We use the Internet in so many ways. Our digital identity is now more a part of our identity when it comes to banking and commerce, our tax returns, government services, and our interactions with other people in society. Those are examples of how our identity is becoming more digital. In a world where crimes involving data theft, identity fraud and online stalking are on the rise, and we are becoming more worried about those, it is crucial to protect data to protect our identity.

Data is not simply information. In fact, as my colleague from Victoria very elegantly gave some examples, it is power. It is a doorway into the private lives of many. It is commercial power. The Liberal Party is deeply concerned that the government's commitment to safeguarding the personal information and privacy of Canadians is less than absolute.

Let me give another example which is not quite related to Bill S-4 but I think is important to mention just for the record. Members might know that since the elimination of the long form census, the government has been looking at linking different so-called administrative data sources in different parts of the government in order to reduce the burden of filling out the census. Indeed, some European countries do not have a census. They have deep links between different pieces of administrative data, and people have to report where they live every time they move. The Privacy Commissioner, whose testimony on Bill S-4 at committee was also quite important, has warned Canadians that we should be very wary of simply moving over to this European system, that there are serious privacy considerations which Canadians should look at and agree with before the government proceeds in that direction.

More and more, all of this information is becoming digital. As an example, although I think this is perhaps not the point at which we should be too concerned, in the 2016 census, the government is planning to automatically use income and benefit information from the Canada Revenue Agency. It can do this because everything is digitized. That information would be automatically tacked onto census information and any voluntary replies that Canadians provide to the national household survey, unless of course the election result in October is such that we do not have to go through that. I just wanted to bring that up for the record.

What I would like to talk about most is the process that happened at committee. We are at third reading now. We are trying to decide whether this is the best possible bill that this Parliament could pass.

Unfortunately, there are definitely concerns about whether the approach in Bill S-4 is too broad and whether there are unintended consequences. I will not go too deeply into them. In fact, my friend, the member for Victoria, has done a much better job than I ever could. Suffice it to say that Bill S-4 identifies situations where personal information can be disclosed without the knowledge or consent of an individual. It permits federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual. It permits organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions. Therefore, there is a danger, we believe, that Bill S-4 is too broad.

The problem is that at committee stage, there really was not sufficient examination of these details. There were 42 amendments proposed by the opposition parties. There was not substantive debate at committee. There were no explanations for why the government members opposed amendments that were based on the testimony of expert witnesses, such as the Canadian Bar Association, the Privacy Commissioner and the Insurance Bureau of Canada. There were 42 opposition amendments, all of them defeated rather quickly without a defence of that vote by the government side.

It has been brought up in debate by previous speakers about how committees have worked in this Parliament and how they could be changed in the next Parliament. I really do believe that a couple of simple steps would be a good start to reforming the committee system.

The first one would be to allow committee chairs to be chosen by a secret ballot in this House, just as the Speaker is chosen. My first encounter with this idea was in fact a motion from a Conservative backbencher, the member for Saskatoon—Humboldt. That would be a good measure to ensure that committee chairs are as independent as possible not only from the government, but from their own party leadership. That would be a step toward what we need to make committees really fulfill their role in Parliament, which is ultimately the role that all of us have, which is to hold the government to account.

The second thing which I think would be very useful in committee, and this reverts to past practice in this House, would be to forbid parliamentary secretaries and ministers from sitting as voting members of committees. That would be a good way to protect the independence of committees for the purpose of committees being able to do a better job of holding the government to account.

I believe that if committees had been working better, we would have at least had on the record somewhere the reasons for rejecting the 42 opposition amendments to Bill S-4. In fact, I also believe that if we really had independent committees, some of these amendments would have been adopted, and even in this majority Conservative Parliament, with those amendments we would have passed a better bill than it looks like we might be passing, given the majority on the Conservative side.

By way of conclusion, I just want to say that without a genuine, collaborative, detailed committee study, I believe that the committee has not held the government to account with regard to Bill S-4. Expert testimony has not been properly either taken into account or discounted with some evidence or some cogent argument. We have in Bill S-4 a bill in which there are potentially overly broad provisions and good reason in fact to believe there are overly broad provisions and unintended questions. That is why I will be voting against the bill at third reading.

[Ève Péclet, NDP, La Pointe-de-l'Île, QC]

Mr. Speaker, my colleague really put his finger on the problem, which is rather widespread and applies to other bills besides the one before us today.

For instance, following public pressure, the government unfortunately had to withdraw Bill C-30 from the order paper. However, there was also Bill C-51 and Bill C-13 on cybercrime. Now we are talking about Bill S-4, which completely destroys Canada's privacy protection regime. It waters down the criteria for obtaining warrants and, in some cases, even allows authorities to access the personal information of Canadians without a warrant.

I wonder whether the member could tell us just how troubled he is that this government says here in the House and elsewhere that it wants to protect Canadians, and yet it introduces a number of bills, like Bill C-51, Bill C-13 and Bill S-4, that put Canadians' privacy at risk.

[Murray Rankin, NDP, Victoria, BC]

Mr. Speaker, it is a pleasure to rise and speak to Bill S-4, which would amend the Personal Information Protection and Electronic Documents Act, called PIPEDA. The bill has the rather misleading title of the digital privacy act.

I will be speaking against this bill for a number of reasons that have been articulated very well in past debates by the member for Terrebonne—Blainville, our digital issues critic. She has brought in a bill of her own. The government took parts of it and did not go as far as it needed to, to actually protect the digital privacy of Canadians.

I would like to, first, talk about why this is such an important bill. Second, I will talk about the history of getting it here. Last, I will talk about some of the critical problems with this bill and propose an amendment at the end of my remarks.

E-commerce is the backbone of the modern Canadian economy and it is only going to be more important going forward. Think of our children and their use of digital material.

My colleague, the member for Toronto—Danforth, made some comments about e-commerce and why this bill, which underscores legal protections for privacy and e-commerce, is so important. He said that the world's largest taxi company has no cars. It is the largest taxi company because it has personal information. It is called Uber.

The world's largest accommodations company, Airbnb, owns no property, but it is the richest and largest company because it owns personal information. The world's largest retailer has absolutely no inventory. He was referring to Alibaba in China.

As we move to what my colleague called the Internet of Things, by 2020, we will have 26 billion devices connected to the Internet. I hope that people appreciate that we are moving into an economy where we need to know the rules of the game and we need to know that our personal privacy in the private sector is protected. Business wants that certainty and consumers demand that what is left of their privacy be treated fairly by those private sector organizations that hold their information.

Canada is really in a unique position on the planet. We are halfway between the European Union, which has a very aggressive data protection regime, and the United States, which has sectoral legislation but not a comprehensive private sector law like PIPEDA, the bill that is before us in its amended form.

I say that we are halfway between those two regimes because, under PIPEDA, Canada has managed to create what is called a substantially similar regime to the European Union. That means that e-commerce companies in England, Ireland, France, and the 28 other countries that make up the EU can confidently share their personal information with Canadians because they know that they will have substantially similar protection. Canada achieved that. The United States does not have anything like that, so companies like Google and Facebook will often use Canada as a launching pad.

If we can make privacy protection sufficient in Canada, it will likely be sufficient for Europeans, who have had the most stringent requirements of privacy on the planet. It is important that we get this right.

It is amazing and very timely that we are having this debate at this time because on Monday of this week a clear signal was given by the Council of Ministers in the European Union that it is going to go for a regulation soon, not the directive that has been enforced for some time. After two years, all 28 countries will have to come up with an even more stringent regime.

That is why this bill is so problematic. It would not help small business, as I will describe, and it certainly would not give consumers the protection that the courts say that they are entitled to. I refer to the case of Spencer in 2014, where warrantless searches were said to be not on for Canadians, yet they seem to be just fine in this bill, which is odd. We need it get it right from a commercial point of view, as well.

I am indebted to Professor Michael Geist, who testified before the industry committee and the Senate, and who is so prolific and thoughtful in his analysis of private sector privacy legislation and other privacy regimes. He talks about how it is has taken us eight to nine years to get to this state.

I wanted to talk about this because the government's ineptitude in helping the e-commerce industry that I talked about and protecting the privacy of Canadians is on full display in the history of this bill.

The Conservatives tell us that it is urgent, that we must get on with it. Well, that is because they have dropped the ball, as I will describe in many ways. It has taken eight or nine years to get to this situation.

The Conservatives left an earlier version of a privacy bill sitting for two years in the House of Commons with no movement whatsoever and then it died at prorogation. How did that happen? In November 2006, the Standing Committee on Access to Information, Privacy and Ethics undertook its hearings on this reform. That was one year later than the five-year review process required by the act.

Just to back up, PIPEDA, the bill before us that is being amended, requires parliamentarians to review it after five years. They could not even get that deadline together.

In 2007, there was a report recommending certain things be done. Nothing seemed to happen. First reading was in 2010 for Bill C-29, the first PIPEDA reform. Second reading of the bill was in October. In September 2011 there was the first reading of Bill C-12, the second attempt to reform PIPEDA. That never got past second reading. It died when the government prorogued. Then another bill, this Bill S-4 was introduced in April 2014. This was the third try. Three strikes are lucky, I guess.

Here we are before Parliament with a bill that when it was in committee, the government said solemnly that it was urgent that we get on with it because it did not want to take a chance on any further delays and amendments. It is laughable the way the government treats the backbone of e-commerce, this privacy legislation. It has taken eight or nine years to get to where we are tonight. In the dying days of Parliament we are debating the legislation. It shows how important this must be to the government of the day.

In my riding, where we have a thriving e-commerce industry, with start-ups trying to develop apps and so forth, the bill is important and the government treats it with a history of neglect, which is the best way I can put the ineptitude I have described.

It is critical for small businesses, as I will describe, because they just do not have the wherewithal of large business to comply with some of the provisions of the legislation. I will come to that in a moment.

What does the bill do? Some of the things it does right is that it has finally agreed with endless Privacy Commissioner recommendations that there ought to be mandatory breach disclosure. If there has been a breach of data by a company, where it is sent to the wrong place and suddenly my personal information is found in the back of a taxi cab on a data stick, someone has to be told about it. That is pretty simple and obviously long overdue. That is a good thing to have in the bill.

Second, there are increased enforcement powers for the Privacy Commissioner, including the notion of compliance agreements that companies would enter into. This is a long-standing consumer protection approach that has now found its way into the bill.

According to experts, such as Mr. Lawford, testifying on behalf of the Public Interest Advocacy Centre, it would likely result in fewer reported breaches because it leaves the determination of whether a breach causes a real risk of significant harm entirely in the hands of the private sector companies.

Do the words “conflict of interest” seem to come up? They do and that obvious conflict of interest is fatal to the purpose of the bill. Why is a company going to want to blow the whistle on itself? It seems a bit odd and others have suggested, as has my colleague from Terrebonne—Blainville, in her Bill C-475, that it ought to be for the Privacy Commissioner, an independent officer of Parliament, to pass on that, not the industries themselves. That was the subject of much criticism in the industry committee, which studied Bill S-4.

That gives me a chance to talk about the attempt by the opposition to actually get meaningful debate in the industry committee. Since I got here, probably the most disappointing thing I have found is the government's utter indifference to any amendments unless they come from its side of the aisle.

There is an effort to have a real dialogue and to improve this and come up with a kind of unanimous support for something which is technical in nature, but the government said no to every single amendment, which, of course, in my experience is the way it does it every single time. I have been on two committees and I have not seen one amendment passed that anybody but the government proposes.

Trying to co-operate with the government to do something which is at the backbone of the new economy and it will not even talk to us. Apparently, that is how the government wants to do business. Fortunately, like so many Canadians, I hope that these are the dying days of a government with such arrogance and indifference to what Canadians want.

The efforts to try to fix this bill fell on deaf ears. My colleague, the digital critic from Terrebonne—Blainville, proposed that the Privacy Commissioner be the one who determined whether a data breach was significant enough to report, which makes sense, as opposed to the fox in the henhouse, where a company has to decided whether it is big or little.

That is not for banks to decide, whether they weigh their reputational risk that they might have versus consumers' rights. I know who could do that, an officer of Parliament. That would be the right person to do that. That is what my colleague suggested. The Conservatives propose putting the burden on companies.

Here is the problem with that, and not only the obvious conflict of interest but there are large companies, think banks, telecoms, companies of that size, that have departments that are responsible for privacy protection. More and more companies have what is called chief privacy officers to regulate this very technical area of the law.

They do a good job sometimes, but they often have this penchant that they obviously feel when they are trying to protect privacy, which is their job description, and not make a career-limiting move when information that is disclosed could cause harm, and the company would be angry with them and shoot the messenger. I have talked to CPOs in companies that tell me that the conflict is alive and well and I can understand that.

Small companies do not have these chief privacy officers, for example, to determine whether there is a significant breach or a significant risk of harm. They have no idea what to do. They want to co-operate, but they do not have the personnel or expertise to do it.

My colleague reasonably suggested that we give them a little help by letting them have access to the Privacy Commissioner's expertise and resources. Is that not a common sense provision? Is that not one that would help those small start-ups in the e-commerce industry that would really like the opportunity to do the right thing but do not have the budget to do it?

The economy in my community, the largest sector now, is not tourism or hospitality, it is high tech. The people who are producing the largest contribution to the Victoria economy are people who are just in this situation, wanting to understand the rules of the game in the new e-commerce, looking to the government to give them clarity, make it easy for them to do the right thing, so they can compete internationally, as they are doing so effectively, and to be onside with the European Union's incredibly stringent rules.

Guess what? They do not have a CPO, paid $150,000 a year or whatever, like the large banks would. The government has done nothing to assist them and they are angry about it. They do not understand why this so-called business-friendly government simply does not get it.

Some 18 amendments were proposed by the NDP and 18 amendments declined by the government of the day. We tried to work it out, but the government just wanted to jam it through. To add insult to injury, for the 97th time it used time allocation on a bill of a technical nature like this. I think the government is over 100 times now.

In the history of Parliament, has there ever been a government that has done this more often? I certainly do not know. I want to study it. I have a student looking at this because the arrogance and the anti-democratic behaviour of the government has to be exposed. The 97th time was for a bill on digital privacy. It is shocking and shameful that we are in this world today with this government.

The Supreme Court has told us that warrantless searches are wrong. They are unconstitutional. My colleague from Toronto—Danforth said we should send it to the court for a constitutional reference. We cannot have yet another loss in the Supreme Court. How many would that be? I have lost count. It is six or seven. How about having a reference to the Supreme Court of Canada?

The leader of the opposition asked for that today with respect to Bill C-51. The government, of course, would never do that. It just wants to go lose again in the Supreme Court.

The Spencer case in 2014 established that warrantless searches are a bad thing. How can the government then put these searches into Bill S-4, the bill before us, and pretend it is going to be constitutional? It is great work for lawyers. I have many friends who welcome the government's position because it is a make-work project for constitutional lawyers, but is it helping the Canadian taxpayers? Is it helping the e-commerce businesses, those little businesses from coast to coast that are struggling in this international economy? Do they have the clarity they need to go forward? Why do we have to waste our time with yet another Supreme Court loss by the government? It makes no sense.

Could the government have co-operated a little with people of good faith who wanted to make it better and solve this problem, as New Democrats tried to do in committee? One would think the government would welcome that, but it simply said no.

My next point is kind of a technical thing, but I want to raise it. We talked about breach notification, and I want to give an idea of how complicated this is for the little mom-and-pop or individual family businesses that are now arising in the economy. Clause 10, which would add section 10.1 to PIPEDA, talks about the kind of notification that is required when there is a breach. I want to give an idea of how complicated this can be and how lack of clarity means something.

Proposed subsection 10.1(5) says, “The notification shall be conspicuous and shall be given directly to the individual in the prescribed form and manner, except in prescribed circumstances, in which case it shall be given indirectly in the prescribed form and manner.”

Three times the word “prescribed” is mentioned, which means it will be prescribed by regulation to follow later. There would be regulations that would define the kinds of things that would have to be done to give notification of a breach. However, as an example, let us take a small business that is trying to do the right thing. When there is a breach, it wants to notify people immediately. What is it going to do? Until there are regulations, it is utterly meaningless.

I know the government will bring in regulations eventually. That is a good thing, and I am sure companies are looking forward to seeing them, but as they plan ahead in this incredibly dynamic sector, they do not have a clue, and neither do we. None of us can say what those prescribed requirements are, because “prescribed” means to follow later in regulations, regulations nowhere to be found. People will have to try to figure that out. People sitting in a little start-up in Victoria or St. John's or Toronto or Montreal will have to try understand how to work their way through this difficult bill.

It is a history of neglect. It is a history of failure to listen to the opposition, which wanted to work together to create this regime. It has a history of eight or nine years in coming to the dying days of Parliament, but we should not worry, because it is urgent now, according to the Minister of Industry.

New Democrats do not believe it.

Therefore, I move:

That the motion be amended by deleting all the words after the word “That” and substituting the following:

“this House decline to give third reading to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, because it:

a) threatens the privacy protections of Canadians by allowing for the voluntary disclosure of their personal information among organizations without the knowledge or consent of the individuals affected;

b) fails to eliminate loopholes in privacy law that allow the backdoor sharing of personal information between Internet service providers and government agencies;

c) fails to put in place a supervision mechanism to ensure that voluntary disclosures are made only in extreme circumstances;

d) does not give the Privacy Commissioner of Canada adequate order-making powers to enforce compliance with privacy law; and

e) proposes a mandatory data-breach reporting mechanism that will likely result in under-reporting of breaches.”

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, I would like to ask my colleague across the way another question about Bill S-4.

According to some experts, many parts of Bill S-4 are unconstitutional. Why, then, will the government not simply take out the parts that are unconstitutional, especially in light of the Spencer ruling?

I would like my colleague to comment on that.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, when we look at the process of Bill S-4, is it any wonder that Canadians look at Ottawa and come to the determination that Parliament is broken? There is a need for real change, and the Liberal Party of Canada will be advocating for that.

Let us look at this bill. We have legislation before us that has some serious flaws. We had the opportunity in committee stage to make some changes with amendments. The majority government, over the years, has made the determination that it does not matter what kind of amendment it is if it comes from the opposition benches. It is an automatic default that amendments are bad unless they are Conservative amendments.

Will the member not recognize that this bill is faulty in the sense that the many amendments that were brought forward, whether from the Liberal Party or other opposition members, did have some merit to them? Would he not acknowledge that fact?

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, it is truly a pleasure for me to ask my colleague opposite a question on behalf of my constituents from Alfred-Pellan in Laval.

In the bills that the Conservatives introduce, the devil is often in the details. When examining the proposals set out in Bill S-4, I had some concerns that I would like to raise.

One of those concerns in particular reminds me of the nightmare of Bill C-51 and its lack of a proper oversight mechanism. Bill S-4 presents the same type of problem. It would allow greater access to personal information without a warrant and without provisions for an oversight mechanism.

In fact, I am wondering why the Conservative government is working so hard to allow snooping without a warrant and why it is creating bigger holes with bills such as Bill S-4.

[Colin Carrie, Conservative, Parliamentary Secretary to the Minister of the Environment]

Mr. Speaker, I want to thank my colleague for his description of the balanced approach we have taken, in contradiction to the NDP's heavy-handed approach. I would like him to comment on how Bill S-4 would amend PIPEDA to reduce red tape for normal business activities.

[Ève Péclet, NDP, La Pointe-de-l'Île, QC]

Mr. Speaker, I heard my colleague mention amendments. However, the Conservatives rejected one of our critical amendments that was supported by many witnesses. That is rather problematic. We wanted to work with the Conservatives, but as usual, they turned a deaf ear in committee and refused to work as a team.

Why did they once again refuse to accept our amendments, which would have corrected and improved the bill so that we could better protect Canadians? As it now stands, Bill S-4 is still quite flawed. For example, it leaves it up to the companies to enforce the regulations, which is unacceptable.

I would therefore like my colleague to explain why the Conservatives rejected our amendments.

[Joe Daniel, Conservative, Don Valley East, ON]

Mr. Speaker, I am pleased to rise in my place today to speak to Bill S-4, the digital privacy act.

Last year our government launched digital Canada 150, an ambitious plan for Canadians to take advantage of the opportunities of this digital age. It is a broad-based ambitious plan to take full advantage of the digital economy as we celebrate our 150th anniversary in 2017. It is the next step to build our nation and to connect Canadians to each other. As the digital economy grows, individual Canadians must have confidence that their personal information will be protected. That is why under digital Canada 150, one of the five pillars is known as “protecting Canadians”.

The digital privacy act would provide important and long awaited updates to our private sector privacy law, the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA. PIPEDA provides a legal framework for how personal information must be handled in the context of commercial activities while also setting guidelines for the collection, use and disclosure of personal information.

These rules are based on a set of principles developed jointly by government, industry groups and consumer representatives. The digital privacy act would strengthen marketplace rules set out by PIPEDA in important ways. In addition to protecting and empowering consumers, the amendments would clarify rules for businesses and reduce red tape.

These guidelines would ensure that vital information is available to Canadian businesses so that they have the necessary tools to thrive in a global economy. Balancing individual expectations for privacy and the need for businesses to access and use personal information in their day-to-day operations is important. Bill S-4 gets this right. It assures individuals that no matter the transaction, their personal information will continue to be protected under Canadian law.

The need to update the rules for online privacy continues to grow. Breaches of personal information held by retail giants like Target and Home Depot, where the credit card information of millions of Canadians was stolen, underscore the need to strengthen PIPEDA with mandatory breach requirements. The bill before us does exactly this by establishing new requirements for organizations to inform Canadians when their personal information has been lost or stolen and there is a risk of harm. The Privacy Commissioner will also be notified.

An organization that deliberately covers up a data breach or intentionally fails to notify individuals and report to the commissioner could face significant fines as a result.

Let me now take a minute to point out some of the ways in which the bill before us creates an effective streamlined regime for reporting data breaches. The digital privacy act establishes a clear and straightforward test that businesses must apply to determine whether or not they are required to report a breach.

If a business determines that the data breach creates a significant risk of harm to a customer or client, then it must report this information both to the individual affected and the Privacy Commissioner.

If the organization determines that the data breach does not pose a risk of significant harm, that is, its data security safeguards were compromised but it avoided a situation where the customers are exposed to a threat, like identity theft, fraud or humiliation, then that organization must keep a record of that breach.

The requirement to maintain these records, even if the breach is determined not to be serious at the time, serves two purposes. First and most important, it requires companies to keep track of when their data security safeguards failed, so that they can determine whether or not they have a systemic problem that needs to be corrected.

An initial breach may not be serious because the information lost is not particularly sensitive. The next time, however, the company and the individual affected may not be so lucky. Keeping track of these breaches will help companies identify potential problems before individual privacy is seriously harmed.

Second, these records provide a mechanism for the Privacy Commissioner to hold organizations accountable for their obligations to report serious data breaches. At any time, the Privacy Commissioner may request companies to provide these records which will allow the commissioner to make sure that organizations are following the rules.

If companies choose to deliberately ignore these rules, the consequences as set out under the digital privacy act are serious. Bill S-4 would make it an offence to deliberately cover up a data breach or intentionally fail to notify individuals and report it to the commissioner.

In these cases, organizations could face a fine of up to $100,000 for every individual they fail to notify. These penalties represent one way that the digital privacy act would safeguard the personal information of Canadians.

The Privacy Commissioner of Canada strongly supports the proposed data breach rules in Bill S-4. He told the standing committee:

I am greatly encouraged by the government's show of commitment to update the Personal Information Protection and Electronic Documents Act, and I generally welcome the amendments proposed in this bill. Proposals such as the breach notification, voluntary compliance agreements and enhanced consent would go a long way to strengthening the framework that protects the privacy of Canadians....

Similarly, the Canadian Bankers Association voiced its support for these amendments, telling the committee:

The banking industry supports the requirements in the digital privacy act for organizations to notify individuals about a breach of their personal information where there is a risk of significant harm. We also support the commissioner's new oversight powers to ensure that organizations comply with these new provisions.

I have been discussing the data breach rules which are a very important element of the bill before us. I would like now to turn my attention to four ways that Bill S-4 would strengthen Canada's privacy rules.

First, the bill establishes strong consent requirements to protect vulnerable individuals online, particularly children. These enhanced consent provisions were introduced as a result of recommendations made by Parliament during the first statutory review of PIPEDA.

Under PIPEDA, organizations need to obtain an individual's consent to collect, use, or disclose their personal information. Under the bill before us, an individual's consent would not be considered valid unless the way the information will be used is clearly communicated in language appropriate to the target audience.

For example, some businesses operate online playgrounds or educational websites that target children and collect personal information of children that is used for marketing and other purposes. Bill S-4 requires that the language used to obtain consent must be such that a child could reasonably be expected to understand the nature, purpose and consequence of sharing his or her personal information. If the consent request is too complicated for the child to understand, the consent would not be valid.

Again, the Privacy Commissioner of Canada supports this amendment. He told the committee:

I think it would be useful to further clarify that consent is to be evaluated from the perspective of the person whose consent is invoked. Organizations would be asked to put themselves in the shoes of various clientele from whom they are collecting information so that consent is as meaningful as possible.

Second, Bill S-4 seeks to harmonize federal laws with provincial privacy protection laws when it comes to a sharing of personal information without consent in narrow, limited circumstances.

PIPEDA already provides for a number of circumstances where personal information can be shared without consent when it is clearly in the public interest to do so. The amendments in Bill S-4 would add to this by allowing information to be shared in order to protect seniors and other vulnerable individuals from financial abuse or neglect, communicate with the family of an injured or deceased individual, or identify a victim of an accident or a natural disaster.

In his testimony before the standing committee, Mr. Marc-André Pigeon, director of financial sector policy at Credit Union Central of Canada expressed his strong support for Bill S-4 and the financial abuse amendment. He said:

In general, we think Bill S-4 does a lot of things right. We are especially pleased with the provisions that would make it easier for credit unions to share personal information with the next of kin or authorized representatives when the credit union has reasonable grounds to suspect that the individual may be a victim of financial abuse.

The third way that Bill S-4 would strengthen PIPEDA would be through changes that would support day-to-day business operations. The digital privacy act would remove unnecessary red tape for businesses by allowing for the collection, use and disclosure of personal information without consent in the context of specific legitimate business activities. For example, Bill S-4 would allow information to be more readily available in order to conduct due diligence in the context of mergers and acquisitions.

Similarly, the digital privacy act would allow businesses to share any type of business contact information in order to carry out normal business activities. It is simply ridiculous that PIPEDA allows an employee to share an office phone or fax number, but not an email address. Bill S-4 would fix this problem, a solution supported by the Retail Council of Canada. It told the committee:

—we support the clarification on the exclusion of business contact information...This section 4 clarification will better equip businesses to conduct their ongoing operations.

Finally, the digital privacy act would make existing compliance tools stronger and more effective. PIPEDA is enforced by the Privacy Commissioner of Canada who can turn to the Federal Court when an organization is found to break the rules. Bill S-4 would also give Canadians the option of taking an organization to Federal Court to order an organization to change its practices or to seek damages.

While the digital privacy act would keep those options open, it would also provide an alternative to court action such as voluntary compliance agreements. Under a compliance agreement, organizations would voluntarily commit to take action to comply with the law to avoid costly legal action. The agreements would be legally binding and would allow the commissioner to hold organizations accountable to follow through on their commitments to private privacy protection.

Again, the Privacy Commissioner expressed his strong support for this tool when he appeared before the standing committee. He said that the compliance agreement amendment was “very necessary” and “helpful for us to implement and apply”.

Canadian organizations care about their reputation and they know that sound privacy practices will have a lasting impact on the legitimacy of their brand. They also know that the reverse is true, that if their customers find out about shoddy privacy practices, their businesses will suffer. This is why the digital privacy act would give the Privacy Commissioner broader powers to name and shame a non-compliant organization to encourage it to take corrective action.

If either of these measures fail to provide the right incentives for businesses to fix their privacy problems, Bill S-4 would give the Privacy Commissioner more time to take them to court. Under the current law, the commissioner only has 45 days after he finishes the investigation to take the organization to court.

The Privacy Commissioner told the standing committee that it was simply not enough time, given the high complexity of issues with which his office dealt. Quite often, the Privacy Commissioner will work with organizations for several months, if not a year, to ensure they follow through on their commitments to fix any problems he has identified. The problem, of course, is that organizations can simply delay taking action for a couple of weeks, knowing that after 45 days, the commissioner will no longer have the option to take them to court. Bill S-4 would fix this problem and would provide the commissioner with a year to take an organization to court for non-compliance.

I have just outlined the five major provisions in Bill S-4, which include: new data breach rules; clear requirements when obtaining consent from individuals, including from minors; changes to support other public interest objectives, like fighting financial abuse; reducing the red tape for day-to-day operations; and new compliance tools for the Privacy Commissioner of Canada.

It is clear that Bill S-4 would deliver a balanced approach to protect the personal information of Canadians, while still allowing the information to be available to the growing, innovative digital economy.

Karl Littler, vice-president of Public Affairs at the Retail Council of Canada, summed it up best when he told the standing committee:

Generally speaking, Bill S-4 strikes the right balance between action to protect digital privacy on digital fraud and financial abuse, while recognizing the strengths of PIPEDA and its forward-thinking technologically neutral approach.

We have it right with this digital privacy act. Both businesses and consumers have been empowered in this digital age, but if Canada is to remain a leading digital nation, Canadians need to have confidence that their online transactions are safe and their privacy is secure.

Bill S-4, the digital privacy act, would strengthen the rules protecting personal information, and that is essential to conduct business in virtually all sectors of the economy. The digital privacy act would go a long way to improving the protection of privacy for Canadians. I urge hon. members to join me in supporting this bill.

[Ed Holder, Conservative, London West, ON]

moved that Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, be read the third time and passed.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I saw that my friend the opposition House leader was out in the foyer of the House of Commons yesterday having a press conference at which he showcased the incredible productivity of the House of Commons during the 41st Parliament. Of course, these were actually Conservative initiatives he had on display, which were passed thanks to our diligent, hard-working, orderly, and productive approach to Parliament. However, I sincerely appreciate the New Democrats' efforts to associate themselves with the record of legislative achievement that our government has demonstrated.

Before getting to the business for the coming few days, I am sure that hon. members and Canadians will have noticed that we have been bringing forward a number of pieces of legislation in recent days, and we will continue to do so for the days to come.

These bills will give effect to important policy initiatives that the Conservative government believes are important for Canada's future. Together they form the beginning of a substantial four-year legislative agenda that our Conservative government will begin to tackle under the Prime Minister's leadership after being re-elected on October 19.

Thanks to the productive, hard-working, and orderly approach that I just spoke about, we have delivered real results on our legislative agenda. In fact, over 90% of the bills that were introduced by our Conservative government between the 2013 Speech from the Throne and the beginning of last month will become law before Parliament rises for the summer.

Now I will go on to the schedule for the coming days.

This afternoon we will continue debating Bill C-35, the justice for animals in service act, also known as Quanto's law, at third reading. I am optimistic that we can pass it later today so that the other place will have a chance to pass it this spring.

I also hope that we will have an opportunity to have some debate today on Bill S-2, the incorporation by reference in regulations bill.

Tomorrow, we will finish the report stage debate on Bill S-7, the Zero Tolerance for Barbaric Cultural Practices Act. Early and forced marriages, honour-based violence and polygamy should not be tolerated on Canadian soil, but unfortunately the opposition disagree and are striving to rob Bill S-7 of its entire content.

On Monday, we will consider Bill C-59, the Economic Action Plan 2015 Act, No. 1, at third reading. This bill will reduce taxes, deliver benefits to every Canadian family, encourage savings with enhanced tax free savings accounts, lower the tax rates for small businesses, introduce the home accessibility tax credit, expand compassionate leave provisions—and the list goes on.

Tuesday will see the House debate Bill S-7 at third reading.

On Wednesday, we will take up third reading of Bill S-4, Digital Privacy Act, which will provide new protections for Canadians when they surf the web and shop online.

On Thursday I will give priority to any legislation to be considered at the report or third reading stages. On that list will be Bill S-2, the incorporation by reference bill, which would help keep our laws up to date in response to emerging scientific and technical recommendations.

Bill C-50, the citizen voting act, will also be considered once it has been reported back from the procedure and House affairs committee. This legislation would play an important role in accommodating the decision of the Ontario Superior Court should we not have the benefit of the Ontario Court of Appeal's decision in time for this year's election.

Digital Privacy Act

[Dan Albas, Conservative, Parliamentary Secretary to the President of the Treasury Board]

Mr. Speaker, I am very happy to be in this place and to rise on behalf of the people of Okanagan—Coquihalla. I am also pleased to express my support for Bill S-4, the digital privacy act.

Bill S-4 provides a number of important updates to the Personal Information Protection and Electronic Documents Act. In my view, these updates are long overdue and will better protect Canadians, in particular consumers, seniors, and children, who could be more vulnerable to sharing personal information online.

I believe that most parents would agree that today's kids' use of the Internet and related digital technologies is unprecedented in our history. Today, children have access to everything online, from information for school projects to gaming, music, movies, and much more.

A wide variety of devices are used to engage in activities such as socializing or gaming with friends, and of course, sharing photos and videos on social media sites that can be viewed by people all over the world. A young teenager may have a picture or a self-made video viewed by tens of thousands of people. While that may be an exhilarating experience, I would also say that it could potentially be a dangerous one.

As we know, a survey conducted in 2013 found that 30% of grade 4 to grade 6 students had Facebook accounts. By grade 11, that increases to 95% of all students, and that is just Facebook. What about Twitter or Instagram or Snapchat?

Businesses are not naive to these trends. Online services can generate massive amounts of revenue. The action of collecting and analyzing personal information for marketing purposes is huge and increasingly valuable. This includes personal information taken from websites, apps, and search engines aimed at kids.

Do kids have any idea that their information is being gathered? Do parents? Is there a clear understanding of what happens to that information that is required to register and download or play a free online game?

Our government recognizes that the digital world offers benefits to children. We are also aware that the online community is often a reality in our day-to-day lives.

The skills kids develop by participating and navigating in online activities can create a significant advantage as they grow up and transition into the job market. Indeed, many high-school-aged kids today have as much, or more, online literacy than a technician would have had a decade ago. However, with growing participation in the online world come increased threats to privacy.

PIPEDA currently contains provisions that protect the personal information of children. As an example, businesses cannot obtain consent in a deceptive or misleading manner. The act also prevents companies from denying access to services on the basis of a refusal to share personal information.

The digital privacy act proposes an amendment to increase protection by creating new safeguards related to the collection, use, and disclosure of personal information. The bill would require that an organization ensure that users, as a group, were able to understand what happens to the information that is collected about them.

I would like to provide this place with a few examples of how the proposed amendment would work.

One example could be an educational website designed to help elementary school kids develop math skills. Under the proposed amendment, requests by that particular website to collect, use, or disclose personal information would need to be understandable by the average elementary school student. This would ensure that these requests used words and language that was appropriate for the website's target audience. Under the digital privacy act, it would not be reasonable to simply expect average elementary kids to understand what clicking the “I agree” box actually meant. If there was no clear understanding as to why the information was being collected, the company would not have valid consent.

As another example, in the case of a mobile app that allowed teenagers to create music recordings, that app would need to obtain the consent of these teens in a manner that would be different if the app were targeting adult users.

I am also aware that during the committee hearings on Bill S-4 , a number of witnesses shared their views on the proposed consent measures.

The Privacy Commissioner of Canada, when expressing his support for this amendment, stated the following:

it is a useful clarification of what consent is, and it has the potential of improving the situation for the issue of consent sought from children.... So, when the individual is a child, if your product is addressed to children, you should think about what is reasonable to expect of a child in understanding the consent being sought. Overall, I think, again, the definition of consent in Bill S-4 will assist generally and will assist particularly groups that are more vulnerable, like children.

The committee also heard from other expert witnesses who offered their support for the consent amendment. For example, the Retail Council of Canada stated its wholehearted support for this proposed amendment on valid consent, emphasizing in particular that, “a vulnerable population such as children should be protected”.

In addition, the Marketing Research and Intelligence Association, which represents the Canadian survey research industry, also wrote to the committee to share its views on Bill S-4. In its submission, it stated that the amendment “provides added clarity for organizations when they seek the valid consent of an individual when collecting, sharing and disclosing their personal information” and “that specifying the elements of valid consent will go a long way to protecting the most vulnerable Canadians, such as seniors and children”.

These are positive endorsements, and I believe they speak to the idea that children need and require extra protection when it comes to their online activities and the protection of their privacy.

In early May of this year, an international network of privacy commissioners, called the Global Privacy Enforcement Network, or GPEN, conducted a worldwide spot check on children's privacy protection. This privacy sweep, as it was called, looked at whether apps and websites worldwide inappropriately gathered information on children.

For some background, GPEN began conducting worldwide privacy sweeps in 2013. The first sweep focused on website privacy notices, and then in 2014, it focused on mobile apps. These sweeps have involved the active participation of Canada's own Privacy Commissioner. They have highlighted areas where privacy practices are lacking. Each time the sweeps have successfully resulted in concrete positive changes to a large number of apps and websites.

This year GPEN also looked at the types of information being collected from children and whether protective controls exist to limit that collection. This year's sweep also looked at whether these sites and applications take steps to make privacy policies understandable to kids, using things like simple language, large print, audio and animation, and whether parental involvement is encouraged.

The Privacy Commissioner of Canada had this to say about the children's privacy sweep:

Children are more connected than ever before and these platforms must bear that in mind when seeking potentially sensitive data such as name, location or email address. This is about protecting children. I can’t think of anything more important than that.

I agree with the Privacy Commissioner.

This year's sweep was a privacy spot check that included 29 data protection authorities from 20 countries, including the Privacy Commissioner of Canada. I believe that many members of this House will look forward to the results of this groundbreaking privacy sweep when it is released in the fall. I expect the results will be of assistance to the Privacy Commissioner and the private sector in determining where changes need to be made to comply with the new enhanced consent requirements under the digital privacy act.

Earlier this year, our Privacy Commissioner also published a top 10 list for protecting children's privacy for organizations with services aimed at children and young people. These tips offered by the Privacy Commissioner emphasize that when it comes to children, the privacy protection bar needs to be set extremely high. I submit that this is why the Privacy Commissioner of Canada has publicly recognized that the amendment would enhance the concept of consent.

We have heard from the Privacy Commissioner and from privacy commissioners that this is an emerging field. I believe that the amendments made to PIPEDA will help protect our children and other vulnerable populations, like seniors. I would humbly ask all members in this place to give these provisions their due review and support.

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, I thank my colleague from Nipissing—Timiskaming for his speech on Bill S-4.

I worked on Bill C-51, which thousands of Canadians opposed. They were worried that the bill would invade their privacy and violate their rights and freedoms. In the answer he just gave, my colleague said that this bill was not necessarily perfect but that we need to take action. I have a question for him.

Bill S-4, and also Bill C-13, would allow greater access to personal information without a warrant and without provisions for a proper oversight mechanism. This is reminiscent of the extremely distressing Bill C-51, which we studied not too long ago.

Why is the government working so hard to allow snooping without a warrant by creating bigger holes with Bill C-13 and Bill S-4?

[Jay Aspin, Conservative, Nipissing—Timiskaming, ON]

Mr. Speaker, I am pleased to rise to speak to Bill S-4, the digital privacy act, which has been referred back to the House by the Standing Committee on Industry, Science and Technology.

Last year, our government launched digital Canada 150, an ambitious plan for Canadians to take full advantage of the opportunities of the digital age. It is a broad-based, ambitious plan to take full advantage of the digital economy as we celebrate our 150th anniversary in 2017. It is the next step to build our nation and connect Canadians to each other.

As the digital economy grows, individual Canadians must have confidence that their personal information is being protected. That is why, under digital Canada 150, one of the five pillars is known as “protecting Canadians”. The digital privacy act would provide important and long-awaited updates to our private sector privacy law, the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.

PIPEDA provides a legal framework for how personal information must be handled in the context of commercial activities, while also setting guidelines for the collection, use, and disclosure of personal information. These rules are based on a set of principles developed jointly by government, industry groups, and consumer representatives.

The digital privacy act would strengthen marketplace rules set out by PIPEDA in important ways. In addition to protecting and empowering consumers, amendments would clarify rules for businesses and reduce red tape. These guidelines would also ensure that vital information is available to Canadian businesses, so they have the necessary tools to thrive in the global digital economy.

Balancing the individual expectations for privacy and the needs of businesses to access and use personal information in their day-to-day operations is important, and Bill S-4 gets it right. It would ensure individuals that, no matter the transaction, their personal information would continue to be protected under Canadian law.

The need to update rules for online privacy continues to grow. Breaches of personal information held by retail giants like Target and Home Depot, where the credit card information of millions of Canadians was stolen, underscore the need to strengthen PIPEDA with mandatory breach requirements.

The bill before us would do exactly this by establishing new requirements for organizations to inform Canadians when their personal information has been lost or stolen and there is a risk of harm. The privacy commissioner must also be notified. An organization that deliberately covers up a data breach, or intentionally fails to notify individuals and report to the commissioner, could face significant fines as a result.

Let me now take a minute and point out some of the ways in which the bill before us would create an effective and streamlined regime for reporting data breaches. The digital privacy act would establish a clear and straightforward test that businesses must apply to determine whether or not they are required to report a breach. If a business determines that a data breach creates a significant risk of harm to a customer or client, then it must report this information both to the individual affected and to the privacy commissioner. If the organization determines that a data breach does not pose a risk of significant harm—that is, their data security safeguards were compromised but they avoided a situation where their customers are exposed to threats like identity theft, fraud, or humiliation—then that organization must keep a record of the breach.

The requirement to maintain these records, even if the breach is determined not to be serious at the time, would serve two purposes. First and most important, it would require companies to keep track of when their data security safeguards fail, so that they can determine whether or not they have a systemic problem that needs to be corrected. An initial breach may not be serious because the information lost is not particularly sensitive. The next time, however, the company and the individuals affected may not be so lucky. Keeping track of all breaches would help companies identify potential problems before individual privacy is seriously harmed.

Second, these records provide a mechanism for the privacy commissioner to hold organizations accountable for their obligations to report serious data breaches.

At any time, the privacy commissioner might request companies to provide these records, which would allow him to make sure organizations are following the rules. If companies chose to deliberately ignore these rules, the consequences, as set out under the digital privacy act, would be serious.

Bill S-4 would make it an offence to deliberately cover up data breaches or intentionally fail to notify individuals and report to the commissioner. In these cases, organizations could face fines of up to $100,000 for every individual whom they fail to notify. These penalties represent just one way in which the digital privacy act would safeguard the personal information of Canadians.

The Privacy Commissioner of Canada strongly supports the proposed data breach rules in Bill S-4. He told the standing committee that:

...I am greatly encouraged by the government's show of commitment to update the Personal Information Protection and Electronic Documents Act, and I generally welcome the amendments proposed in this bill.

Proposals such as breach notification, voluntary compliance agreements and enhanced consent would go a long way to strengthening the framework that protects the privacy of Canadians....

Similarly, the Canadian Bankers Association voiced its support for these amendments, telling the committee:

The banking industry supports the requirements in the digital privacy act for organizations to notify individuals about a breach of their personal information where there is a risk of significant harm.... We also support the commissioner's new oversight powers to ensure that organizations comply with these new provisions.

I think it is clear that Bill S-4 would deliver a balanced approach to protecting the personal information of Canadians, while still allowing for information to be available in a growing, innovative digital economy.

Mr. Karl Littler, vice-president, public affairs, Retail Council of Canada, summed it up best, when he told the standing committee:

Generally speaking, Bill S-4 strikes the right balance between action to protect digital privacy on digital fraud and financial abuse, while recognizing the strengths of PIPEDA and its forward-thinking technologically neutral approach.

I think we have it right with the digital privacy act. Both business and consumers have been empowered in the digital age, but if Canada is to remain a leading digital nation, Canadians need to have confidence that their online transactions are safe and their privacy is secure.

Bill S-4, the digital privacy act, would strengthen the rules protecting the personal information that is essential to the conduct of business in virtually all sectors of the economy. The digital privacy act would go a long way to improving the protection of privacy for Canadians.

I urge hon. colleagues to join me in supporting this bill.

[Craig Scott, NDP, Toronto—Danforth, ON]

Mr. Speaker, I am sure my colleague would, but I think we will keep the topic on Bill S-4 today.

[Craig Scott, NDP, Toronto—Danforth, ON]

Mr. Speaker, it is my pleasure to speak to Bill S-4, and I would like to do so by addressing three themes. The first will be how Bill S-4 reflects rather badly on our democratic process. The second theme will be that Bill S-4 is already hopelessly out of date. It is behind the technological times. The third theme is that there are worrisome features in Bill S-4 to the extent that it would inadequately protect privacy, even within the limits of what it is trying to do.

On that first theme of democracy, we should recall that a lot of what has subsequently come through the House in a series of different bills started with Bill C-30, which I always called the Internet surveillance bill. It got so panned by experts and civil society that the government tried to take it off of the table in the House by sending it to committee for study before second reading. It then disappeared, because the government knew that too much in there had attracted too much early attention from Canadians.

I mention that, because parts of it have begun to reappear in bits and pieces since Bill C-30 disappeared.

Bill S-4 uses one of the same techniques as Bill C-30 to try to take it away from public scrutiny. It is ironic that the method it would use is one that was recommended by the McGrath committee in 1982 or 1984, which is to make better use of committees by having them look at bills before the principle of the bill has been fixed, by having the government send the bill to committee before second reading. That is between first and second reading. It would allow committees to effectively look at the bill as a strong draft from the government, but for MPs, presumably from all parties, to try to improve and perfect the bill without being hamstrung in the way we are now in our committee study of bills by the principle having been fixed, as it gets fixed when we go to second reading for a bill in principle.

Bill S-4 did get sent to committee and, surprise, surprise, with the way that the government has operated since I have been here and since it got a majority in 2011, there were no amendments. The government rejected every amendment and presented no amendments itself. It was as if it had not heard anything that had convinced it of anything, despite all of the witnesses who had appeared and who, in very measured tones and with a very focused analysis, had indicated that there were ways, even within the limited confines of what the government was trying to do in the bill, that the bill could be improved. However, the government, through its MPs on that committee, decided that the bill was fine as-is.

Look at House of Commons Procedure and Practice, second edition, on page 742. It tells us what this procedure was intended to be when the McGrath report came down in 1982 or 1984. It was intended to be an empowering mechanism for the House in relation to government legislation. It was meant to create more of a partnership between MPs and the government. It says:

This empowers Members to examine the principle of a bill before second reading, and enables them to propose amendments to alter its scope.

In the end, this was a subterfuge. Who here is going to doubt that the reason it was sent to committee between first and second reading was to get it off of the agenda in the House, which can tend to lead to a bill receiving more public attention and producing the kind of civil society push back that we have seen meet the government's bills on and on for the last little while? It was a mechanism to reduce its visibility and to have it reappear just about now, with two weeks to go, when there is no steam, no energy, nothing left for civil society to get its mind around in terms of general resistance.

My colleagues have mentioned a problem with this bill, as with other bills that start in the Senate, which is a structural problem that will hopefully be dealt with after the next election by having the Senate put in its proper place. There is also something here, which is that there has been no acknowledgement by the government that this bill probably does conflict with the Spencer decision of 2014 in the Supreme Court of Canada.

This decision recognized the nature of the privacy interests in Internet users' data, including all the metadata that identifies various features of their existence on the Internet, and indicated that in a police context, warrants are needed in order to get access to that information.

PIPEDA, as amended by Bill S-4, would now allow private sector organizations, using the guise of fraud investigations, contractual breach investigations, et cetera, to request of any other private actor all that same information, and nothing is put in here by way of safeguards. It is as if the Spencer decision never came down.

We have had no opinion tabled anywhere from the Department of Justice, through the Minister of Justice, to say that under section 4.1 of the Department of Justice Act, the minister has assessed that Bill S-4 complies with the charter, even after the Spencer judgment. That is because the government never tables opinions and never takes charter arguments seriously.

The record is clear. Last year alone, something like a dozen judgments came from the courts, and 10 out of the 12 found that the government's legislation breached the charter or other principles of law.

The bottom line is that this bill is not a good story for democracy, but that again, I am sorry to say, is not a new story.

The second theme is that the bill has missed the boat.

This all started in 2007. That was when the PIPEDA review was mandatory under the statute, and very quickly a couple of different bills began to appear in the House. They just never got through the minority Parliament at all. Nothing really changed along the way. The government is still stuck back in whatever its thinking was around 2007.

Let me quote from the Library of Parliament's background paper on Canada's federal privacy laws. It says:

As advances in technology increase the ease with which information about individuals can be gathered, stored and searched, the need to protect the privacy of such information presents a rapidly evolving challenge for legislators.

That challenge has not been met. It is as if the government does not know how much of an information economy we have rapidly, almost exponentially, year by year, evolved into being.

How about these basic facts?

The world's largest taxi company right now has no cars. It is the largest taxi company because it has information. That is Uber.

The world's largest accommodations company, Airbnb, owns no property, but it is the richest and largest company by virtue of how it owns information.

The world's largest retailer has absolutely no inventory. That is Alibaba, in China.

This is the world we live in now, and there is nothing in the PIPEDA amendments, in Bill S-4, to indicate the government is at all aware of what it means to be living in this economy.

We should think about the so-called Internet of Things. According to recent research, by 2020, 26 billion devices will be connected to the Internet. That is roughly an average of something like three or four per person on earth. There is no evidence that this bill even comes close to understanding the privacy issues that arise from the fact that we are increasingly living in a connected world in which our phones will be reporting on our heart rates, our fridges will report on our eating habits and even order our groceries, self-driving cars will be out there on the roads, and thermostats and smart meters will monitor our every movement. There is nothing in the bill in that regard. All I would say is that amendments that are 10 years out of date are not exactly something to write home about.

The third theme is the inadequacies and the problems in the bill.

Let me just list them. They have been mentioned before.

First, the way in which the bill deals with giving consent on the web is inadequate after the Spencer case.

Second, the loophole that allows for private organizations to pass on information without any kind of safeguard system analogous to a warrant system, on the simple basis that they are investigating breaches of agreement or fraud or financial abuse, is a recipe for incursions into privacy.

Third, I would end by saying that the reportability standard whereby, if there is a breach of data, a company or holder of the data must tell the person whose data has been lost on the basis of a real risk of significant harm is a subjective standard that is assessed by the company. There is no real system to ensure that it does not become a mechanism for breaches to be hidden from public view and hidden, therefore, from accountability.

[Rodney Weston, Conservative, Saint John, NB]

Mr. Speaker, Bill S-4 would better protect the privacy of Canadians by requiring organizations to inform Canadians when their personal information had been lost or stolen. Organizations would also be required to keep all records of data breaches and report significant breaches to the Privacy Commissioner of Canada. Organizations that deliberately covered up a data breach or intentionally fail to notify individuals and report to the commissioner could face up to $100,000 for every individual they have failed to inform.

The law being put into place would protect Canadians. It would force businesses to be expedient when they were dealing with the personal information of Canadians. I trust that businesses in our country will take this very seriously when they look at the penalties that are in place for any breach of privacy that might occur.

By keeping these records, if a complaint is laid, the Privacy Commissioner can go to the records at any time and if the breach has not been recorded or if there is any further breach, the maximum penalty can be applied.

[Rodney Weston, Conservative, Saint John, NB]

Mr. Speaker, I am pleased to rise today to speak Bill S-4, the digital privacy act, which would significantly strengthen Canada's private sector privacy law.

In today's increasingly digital world, Canadians need to have confidence that their online transactions are secure and their privacy is protected. Unfortunately, data breaches, computer hacks, malware and other online threats are simply a reality of today's modern digital landscape. If Canadians do not trust that their private information is safe when it is in the hands of business, then they will not provide it. Without the free flow of information, our digital economy will stall. This is why strong, effective privacy laws that protect personal information are essential to building consumer trust and confidence. Canadian businesses need clear and balanced rules to follow so that their handling of personal information meets the expectations of Canadians.

The digital privacy act would provide important improvements to Canada's private sector privacy legislation, the Personal Information Protection and Electronic Documents Act, PIPEDA. Canadians want control over their personal information and our privacy laws give them exactly that. PIPEDA requires businesses to obtain a person's consent before collecting his or her personal information and ensures that this information is used only for the stated purposes. PIPEDA also gives Canadians control over which type of information is collected about them, how it is used and with whom it is shared. PIPEDA holds businesses accountable for the private information they hold, requiring them to keep it safe and out of the hands of hackers or thieves.

Further, the law gives Canadians the right to access their information at any time to make sure that it is accurate while also giving the Privacy Commissioner strong tools to enforce compliance. Privacy is a major concern for Canadians and they want to know that their personal information is secure. Businesses that can offer that security have a clear competitive advantage.

If I have a choice between a company that does not make protecting my personal information a priority versus one that tells me exactly what information it is collecting and how it is protecting it, I am going to choose the business that offers me the most protection. Businesses that are clear about what they are doing with personal information and have appropriate safeguards in place to protect that information will have an advantage in the marketplace.

Thankfully, limiting the collection, use and disclosure of personal information, having appropriate safeguards and being open about privacy practices are all part of the founding principles of PIPEDA. PIPEDA applies to all private sector organizations operating in Canada. It came into force on January 1, 2001, and its framework has stood the test of time. It is based on a set of 10 internationally recognized principles called the fair information principles. These principles give individuals control over their personal information and the way it is managed in the private sector. They establish strong privacy rights for Canadians and real obligations for companies.

By requiring businesses to protect personal information, PIPEDA is not only protecting the privacy rights of Canadians but is helping contribute to a vibrant Canadian economy. These founding fair information principles for PIPEDA mean that the act is flexible and scalable and allows data to move seamlessly across borders, all of which are good for Canadian businesses. PIPEDA is a flexible piece of legislation. It is technology neutral, which means that it evolves and will apply to new technologies in businesses as they emerge. It applies to all categories of businesses, not just one sector. It also lets companies find innovative new ways of protecting privacy because it is not overly prescriptive.

As I said, PIPEDA is also scalable. It applies to organizations of all sizes in Canada. Whether a small business or a large multinational corporation is doing business in Canada, it is governed by PIPEDA. Having a foundation based on these internationally recognized principles, being flexible and scalable, all contribute to PIPEDA reducing unnecessary red tape for businesses while also maintaining and protecting the privacy rights of Canadians. This puts Canada at a strategic advantage globally.

PIPEDA's balance between these two approaches allows Canadian businesses to be competitive in different markets around the world. By not being overly burdensome, PIPEDA allows Canadian businesses to adapt to new technologies as they emerge, thus allowing them the opportunity to compete with international markets and increase their revenues. At the same time, because PIPEDA is not overly lenient, Canadians can feel secure that their personal information will be protected in their dealings with businesses in Canada. It is clear that privacy is important for businesses and our economy.

Clearly, PIPEDA supports business activities, while protecting the personal information of consumers. Bill S-4 takes Canada's privacy protection a step further and clarifies rules for businesses.

Our government recognizes that companies need to have access to and use personal information to conduct business activities. That is why Bill S-4 provides a clear set of guidelines for businesses when it comes to the collection, use and disclosure of the personal information of Canadians in the course of commercial activities. These activities can include undertaking a merger or acquisition, processing an insurance claim or simply share an employee's email address and fax number with another company.

Bill S-4 would maintain PIPEDA's balanced approach and would provide important clarifications for businesses to conduct themselves with confidence, while at the same time offering consumers the assurances they need that their information is being protected.

The digital privacy act would also provide for oversight and accountability to ensure that when safeguards failed, individuals would told about it and could take the appropriate measures to protect themselves.

The balanced approach found in PIPEDA and continued in Bill S-4 is an important element in establishing a growing trust and confidence in today's digital economy. Once again, it is that consumer trust and confidence that will help businesses and the economy to flourish. It is that trust and confidence that will help us to continue to build a digital Canada.

Thanks to PIPEDA and the improvements proposed in Bill S-4, Canadians can be confident that their privacy is being protected when they provide their personal information to businesses.

The digital privacy act proposes common sense changes that will reduce red tape for businesses, while also maintaining and protecting the privacy of Canadians. A clear set of rules for privacy protection allows businesses to focus on providing exceptional service to their clients, while simultaneously offering them an advantage in today's increasingly competitive worldwide marketplace.

I want to take this opportunity to urge all hon. members to join me in supporting the bill.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, the NDP is entirely supportive of the need to update our privacy laws, especially in the digital age, when we frequently share our private lives online. However, something about this bill really bothers me, which is why the NDP will not be supporting it.

Unfortunately, although the bill is called the digital privacy act, some of its measures actually work against privacy by opening the door to more sharing of personal information among organizations, on a voluntary basis, without the knowledge or consent of the individuals in question. The Privacy Commissioner even raised some concerns about this. This will really open the door to a lot of information sharing. Sometimes it will be for legitimate reasons, and sometimes not.

Why has the government not taken action in this regard? Why did it not include the amendments put forward by the Privacy Commissioner to ensure that this bill really does protect Canadians?

[Tilly O'Neill-Gordon, Conservative, Miramichi, NB]

Mr. Speaker, I am pleased to have the opportunity to speak to Bill S-4, the digital privacy act. The bill would make significant improvements to Canada's private sector privacy legislation, the Personal Information Protection and Electronic Documents Act, or PIPEDA.

One aspect of the digital privacy act that has not received a lot of attention is how the bill would help reduce red tape for businesses. Reducing red tape for Canadian businesses saves money and helps encourage greater investment in our economy. I would like to focus my comments today on these important changes.

We must always bear in mind that strong privacy legislation is not just good for everyday Canadians; it is also good for businesses. In our rapidly evolving digital economy, personal information is becoming increasingly valuable, creating tremendous new opportunities for businesses to innovate and develop new products and services.

Canadians will not provide their private information to businesses if they do not trust that it will be protected. At the same time, if the rules are too cumbersome and complex for businesses to manage and show no clear benefit to consumer privacy, then companies will struggle to implement them. It is for these reasons that the digital privacy act proposes a number of common sense changes to help businesses protect privacy in a way that does not hinder their ability to conduct business.

All of these changes make sense. They were all identified by the Standing Committee on Access to Information, Privacy and Ethics when it conducted the first statutory review of PIPEDA back in 2006. Businesses have been waiting a long time for these changes, and it is important that we move now to implement them. I would like to briefly touch on each of these important changes.

The first changes are in relation to business transactions. Currently, if a company wants to examine personal information as part of its due diligence—for example, if a business is thinking of buying a magazine and would like to look at the list of current subscribers—it first needs to obtain the consent of each individual subscriber. This requirement not only presents a tremendous burden for the company but is also often impractical, given the confidential nature of most prospective business transactions.

Bill S-4 fixes this problem by creating an exception to the requirement for consent that would allow businesses to share information in this context. This must be done in such a way that the privacy interests of those involved are protected.

Under the digital privacy act, information could only be shared for the purpose of assessing the feasibility of the transaction. If the transaction did not proceed, the information would have to be destroyed or returned. If the transaction did proceed, then the individuals would have to be informed.

This amendment would implement a recommendation made by the standing committee during the first statutory review and is modelled after a similar exception that is currently in place in Alberta and British Columbia under their private sector privacy laws.

In addition, the amendment has widespread support among stakeholders. Ms. Éloise Gratton, a lawyer with the Borden Ladner Gervais law firm, appeared before the Standing Committee on Industry, Science and Technology. She said:

I offer my support to two important provisions in the bill: mandatory breach notification and business transaction exception.

The next important amendment I would like to highlight is the change to how business contact information is dealt with under PIPEDA. Currently, certain types of business contact information are not defined as personal information. Specifically, a person's business title, address, and telephone number are not considered personal information and are therefore not regulated.

As was pointed out during the first statutory review of PIPEDA, this would present an obvious problem: only a few bits and pieces of information are considered to be business contact information under PIPEDA. A person's work email address or fax number or their LinkedIn account or a business Twitter handle are all considered personal information.

The digital privacy act would correct this problem by creating a technology-neutral definition of “business contact information”. It would do this by being inclusive of all types of communication points of contact, such as social media applications like Twitter and LinkedIn. With this change, a sales manager would now be allowed to share an employee's work email address with a client without having to get permission first. This would create a better balance between protecting privacy and allowing information to flow in a digital economy. At the same time, the act would continue to protect business contact information if it is used outside of a business context.

Another important amendment in the digital privacy act would be the clarification around the rules for when someone's personal information is included in their work product. An example would be when a garage mechanic signs off on a vehicle's inspection or a work estimate. The fact that the mechanic signs off on the estimate would mean that it now contains his personal information.

Currently, under PIPEDA, a business must obtain an individual's consent to use or share any work product he or she creates if it contains the individual's personal information. Again, this seems like a rather silly and unnecessary bit of red tape. Bill S-4 would fix this problem by ensuring that businesses can use their employees' work without getting the employees' consent.

Finally, the digital privacy act would ensure that insurance companies can use witness statements when assessing or processing any insurance claim. Witness statements provided to the police or other investigating authorities may contain personal information. For example, if I were to witness someone running a red light that results in a car accident, my statement to the police would include personal information. Currently, under PIPEDA, an insurance company processing any claims for the accident would need to get the consent of anyone named in my witness statement in order to use it. Such a requirement would create the potential for someone who breaks the law to use privacy as a shield to avoid responsibility for his or her actions.

The digital privacy act would fix this problem with an amendment that would enable an organization to obtain a witness statement without having to obtain the consent of an individual whose personal information is contained within it. However, this experience would only apply when the information is necessary to assess, process or settle an insurance claim.

In addition to strengthening privacy protection in Canada through measures like mandatory data breach reporting and stronger enforcement powers for the Privacy Commissioner, which had been discussed extensively in this place, the digital privacy act would also make a number of important changes that would cut red tape for Canadian businesses.

I hope hon. members will join with me in supporting a balanced and carefully considered bill that would dramatically improve Canada's privacy law.

[Pierre Dionne Labelle, NDP, Rivière-du-Nord, QC]

Mr. Speaker, I am pleased to rise in the House today to speak to a bill, perhaps for the last time in this 41st Parliament. I would like to thank the interpreters, who have helped us so much these past four years, as well as the team of clerks and pages and everyone who supports our work every day.

In the digital age, privacy is extremely important. It often feels as though I have a clone that is wandering around computer networks with information on my life, my past, my present, my sexual orientation, my purchases, my consumption and my travels. All of these data are like a twin over which I have no control. That is a problem.

Unbeknownst to me, my twin goes from company to company, government agency to government agency. No one will inform me that an agency is using the information my clone carries to determine how it will approach and deal with me.

A number of distinguished analysts who testified obviously told us that this bill could be challenged by the Supreme Court. The court recently ruled that a warrant was required to access the personal information and IP addresses of customers of Internet service providers. It is therefore highly likely that a number of provisions in this bill will be challenged by the Supreme Court.

The Conservative government has a strange relationship with the Supreme Court. This will not be the first time that a bill has ended up before the Supreme Court. Under the Conservative government, we have gotten used to seeing bills that, according to experts and parliamentarians, violate our charters and our laws. These bills risk being challenged by the Supreme Court and, in fact, they are being challenged. The government has suffered many defeats, and yet again it is risking being put in its place.

Introducing these constitutionally weak bills is a real waste of time. How insulting it is to the intelligence of the members of this Parliament and the members of civil society who give their input on these issues. What contempt it shows for our institutions and the Canadian Constitution.

The Conservatives have botched the drafting of dozens of bills. Take Senate reform as an example. Everyone knew that that measure would be declared unconstitutional, because 50% of the population would have had to agree, but the government went ahead with the measure anyway.

As for the appointment of Justice Nadon, everyone said that it would not work. The appointment was challenged, and Justice Nadon was ineligible under the Supreme Court Act. The matter still had to go to court, but everyone knew how it would end. Once again, it was an insult to the intelligence of parliamentarians and the experts who were advising us.

Another example is the repatriation of Omar Khadr. Two Federal Court rulings and a Federal Court of Appeal ruling ordered his repatriation, but the government still took the matter to the Supreme Court. What happened? The Supreme Court of Canada upheld that young man's rights and even said that they had been violated since he was captured in 2002. The government's attitude puts it at odds with civil society, the opposition members and the Supreme Court.

We told the House that mandatory minimum sentences were not constitutional. The government pushed ahead anyway. What happened? The Supreme Court said that the opposition was right and that these sentences were not constitutional. The Federal Court of Appeal had come to the same conclusion, but the government did not listen to that court.

The government tried to close safe injection sites by passing a law. What happened? The Supreme Court found that the site in Vancouver could continue to operate without the risk of criminal prosecution. The government's refusal to grant an exemption to InSite violated the right to life guaranteed in the Canadian Charter of Rights and Freedoms. This once again showed the Conservative government's contempt for our institutions, the Canadian Constitution and the Canadian Charter of Rights and Freedoms.

The Conservative government also lost its case before the Supreme Court regarding the retroactive application of the Corrections and Conditional Release Act. It was not constitutional to do away with accelerated parole review. Those who challenged it were granted parole. The NDP told the House that the measure would not work and that it violated the Canadian Constitution and the Canadian Charter of Rights and Freedoms. The government did not listen. It went to the Supreme Court and lost once again.

Another case that the government lost before the Supreme Court is the case regarding the Canadian securities commission. We told them that setting up a Canada-wide commission would not work since that is an area of provincial jurisdiction. The government did not listen to us and said that it was going to set up the commission anyway. The government went to court and the Supreme Court told the government exactly what the opposition had told the House. What is more, the Supreme Court suggested that the government take a co-operative approach. This government has failed to co-operate with the provinces, as we have seen with the TFSAs in the latest budget. By 2080, that measure will cost the provinces $34 billion. Did the government discuss that with the provinces? Did it seek to co-operate with them? Not at all.

I am getting to my last and main point: Internet users' privacy. The issue is whether searching through people's personal information is lawful or not. I am reiterating this because the government has to understand that it cannot use any pretext whatsoever to search through people's personal information: the police need a warrant to obtain the name, address and telephone numbers associated with a subscriber's IP address. The Supreme Court has told the government that.

We are debating Bill S-4, which could still go to the Supreme Court. How do we know? We listen to the experts. Not all members claim to be experts in law, computer issues and general issues that apply to data management. People appeared before the different committees, in the Senate and the House of Commons, to explain why the current version of this bill is weak. We spoke about Michael Geist earlier. In his testimony, he said that although the government claimed that Canadians should not worry about this provision, this exception will let companies share personal information with other companies or organizations without the court's authorization. That is one of this bill's flaws. He added that the failure to require transparency, disclosure and accountability with respect to the communication of information without a warrant was a glaring omission in this bill.

This is not the first time that we have told the Conservatives that their laws are flawed. They are unconstitutional. Here again, provisions will be struck down by the court. Why not fix this now? Why waste time, money and energy in the Supreme Court just to be slapped on the wrist again? The Conservatives have been slapped on the wrist 10 times by the Supreme Court. They may want to continue. Perhaps systematically going against Canada's Constitution and the Canadian Charter of Rights and Freedoms is part of their political agenda. That seems to be the case. The Conservatives do not like the Canadian Charter of Rights and Freedoms, because in the case of the 10 laws that I mentioned, the Conservatives went against the charter.

Is there someone who can read it and interpret it properly? Why not listen to the opposition once in a while?

[Jinny Sims, NDP, Newton—North Delta, BC]

Mr. Speaker, I want to thank my hard-working colleague for the very thoughtful question. There is nothing more important than one's private information. There is some information people just do not want to share with other people. We have insisted on removing the provisions in Bill S-4 that would allow organizations to share personal information without Canadians' consent and without a warrant. We have also said that there are loopholes in this bill that need to be addressed. We tried to address them with amendments, but of course, we were ignored.

However, we are not the only ones who are saying that. Here is a quote from Michael Geist, who is a law professor at the University of Ottawa:

the broad provision that we have here opening the door to massive expansion of non-notified voluntary disclosure without any of the kinds of limitations that we typically find even the courts asking for should be removed.

He has also said:

While the government has claimed that this provision should not concern Canadians, the reality is that the broadly worded exception will allow companies to disclose personal information to other companies or organizations without court approval.

It is a lack of transparency, a lack of disclosure, and a lack of reporting requirements and believing that these companies can police themselves. Surely we have learned lessons from other situations. There are some glaring omissions in this bill, and they should be addressed.

As a matter of fact, Michael Geist even says, “[This bill] is both not well studied and ought to be fixed. Canadians deserve better”.

[Anne Minh-Thu Quach, NDP, Beauharnois—Salaberry, QC]

Mr. Speaker, I thank my colleague for her speech on defending privacy and people's personal information.

Through Bill S-4, the Conservatives are making a third attempt at talking about privacy protection, but they missed the mark yet again. As my colleague pointed out, the opposition parties, including the NDP, proposed a number of amendments, but the Conservatives categorically rejected them all.

Some of the amendments would have prevented companies from determining whether or not privacy has been breached and whether or not complaints should be addressed. We want a third party to take care of this in order to keep the process transparent and effective.

We are also calling for the Federal Court decision to be complied with so that information shared between companies is better protected and Canadians' personal information cannot be shared without their permission.

Bill S-4 does not do any of that. We are talking about a very serious breach of privacy. The current Privacy Commissioner raised some concerns about this. This bill still has a number of major flaws.

I would like my colleague to comment on that.

[Jinny Sims, NDP, Newton—North Delta, BC]

Mr. Speaker, it is my pleasure today to rise and speak to Bill S-4.

As my colleague mentioned a couple of minutes ago, I too have very serious concerns that here we are in a parliamentary democracy with elected MPs sent here by their constituents to do the work of Parliament, and Conservatives have brought forward a bill introduced by the unelected Senate. It sort of begs this question. What was the real agenda behind doing this? Was it to fast-track it? Was it to try to give the Senate some sense of credibility as it goes through some very difficult and challenging times?

Nevertheless, it is about process, and now that I have made my point, I also want to make the point that in Parliament, as my colleague across the way pointed out, there is a natural rhythm as to how bills are introduced in the House and debated. The government, in its wisdom, first took a Senate bill instead of spending the time, of which it has a lot, to bring forward its own bill. It took a Senate bill and, even before second reading, basically declared that it was not willing to accept any amendments, which really makes one wonder what the purpose has been behind a lot of legislation.

Now I know that my colleagues across the way have an allergy to evidence, science, and data and do not really like listening to all the expert witnesses that are flown in to appear before committees. The interesting thing is that even before they heard from those witnesses, they started to make comments such that they did not want to accept any amendments because if they did, the bill would have to go back to the Senate. It does not seem to me to be a good reason to bring forward legislation that is poorly thought out.

I am not saying it is not needed. It is.

As a matter of fact, my esteemed colleague from Terrebonne—Blainville introduced Bill C-475, which would have actually addressed many of the concerns that Canadians want addressed. That is an example of a well-thought-out bill that would not overreach but would actually do the job that is needed, which is to modernize our code of conduct around personal information. With the advent of electronic and digital media, we absolutely need some changes.

Getting back to the bill, once again, it is a process that is flawed. Experts came forward and gave testimony. I sometimes wonder, if the government's mind is already made up that it is not going to accept any amendments, what the purpose is of flying in experts to present their testimony. To me, that is the highest sign of disrespect. It basically says the government has already made up its mind, but just to make witnesses feel better, it will hear from them. That is really bad form.

Here is something else. The NDP put forward 18 amendments, well thought out and researched, supported by the evidence that was presented and by experts; and other people presented 14 other amendments. True to their commitment or the bizarre statement before the bill got debated, there were zero amendments accepted by my colleagues across the way. So much for committees working with consensus.

I have often heard ministers from the other side of the House say they have to rush things through the House because at committee stage experts will be heard and that is when we get to have the really meaty debates. I have never bought that, and evidence bears out that it is not how committees work. Despite hearing expert witnesses and hearing from the opposition, the Conservative government accepted zero amendments, and that says a lot about the process.

Now the bill is back in the House, and we are debating it, but once again, there is time allocation. The government could have moved on the bill over the last number of years, but it chose not to. Here we are in the last three weeks, when suddenly the Conservatives have rediscovered that they had better do something. After all, it is election time. They are now moving time allocation to prevent the Canadian public from knowing what is really in the bill. One way to do that is to limit and shut down debate, which seems to be a very common move by the government.

Here are some facts and figures. The Conservatives made 1.2 million requests to telecommunication companies to obtain Canadians' personal information in just one year. Some 70% of Canadians feel less protected today than they did 10 years ago. With this bill, they have reason to feel even more concerned and worried, because now there are all kinds of loopholes in the bill whereby their information can be shared way beyond the person they give it to.

Some 97% of Canadians say they would like organizations to let them know when breaches of personal information occur. That is reasonable, but if companies are giving away data themselves, I personally see that as a breach, because they have breached my trust, because I gave the data to them. We have some concerns around that as well. Some 80% of Canadians say they would like the stiffest possible penalties to protect their personal information, and 91% of respondents—not 51%, not 41%, not 21%, but 91%—are very or extremely concerned about the protection of privacy. It seems to me that the government should be paying some attention to what Canadians are feeling and their fears.

There was also a Supreme Court ruling, on June 13, 2014, pertaining to the sharing of personal information. The Supreme Court stipulated that subscriber data, including name, address, email address, phone number, ID address, et cetera, cannot be disclosed to a third party without a warrant. In light of this decision, the constitutionality of certain provisions in Bill S-4 is questionable.

I am sitting here thinking that a government that really wanted to do due prudence would actually pay attention to the fact that the Supreme Court had made a ruling. Despite that ruling, we did not see any amendments from the Conservatives, nor were they willing to accept any of ours, which really lets me know that to pander to their friends, they are willing to sell out Canadians, they are willing to ignore the Supreme Court ruling, and they are burdening hard-working taxpayers with future challenges in the courts, because that is where this will certainly end up.

The NDP believes that Canada needs a mandatory data loss or data breach reporting mechanism based on objective criteria. We are not the only ones who are saying that. Witness after witness said that we need the Privacy Commissioner to have some powers over this.

Huge companies get our data through nefarious means, some of them very innocent, like when we pay bills with a credit card. They not only get what we paid and where we bought something but all that micro-targeting information can now be moved on to other companies when a company deems fit. To me, that is just not acceptable.

I would urge my colleagues across the way to not ignore Canadians or the Supreme Court ruling. Let us make sure that we address the deficiencies in this bill.

[Pat Martin, NDP, Winnipeg Centre, MB]

Mr. Speaker, I am less interested in the speech that my colleague was given to read into the House of Commons today and more interested in hearing his views about the fact that the bill is labelled “S-4”, which means it did not originate in the House of Commons; it originated in the Senate.

In my view—and I would like the view of the member for Elmwood—Transcona, to see if he agrees with me—senators have no legitimate right to introduce legislation. No one elected them to be legislators. In fact, they are appointed, usually because they were good fundraisers on behalf of their party. They were hacks and flacks and fundraisers, and they get rewarded with this lifetime sinecure in the other place.

For God's sake, how did we ever get to the point where we are debating legislation that they have developed? How have we slipped to this, in the status of our parliamentary democracy, that it is the House of Commons' job, that the elected representatives, the duly, democratically elected representatives in the House of Commons, have to end up debating legislation that was put together by a bunch of unelected, undemocratic, and under indictment half the time, senators?

Does he agree with me that there is something fundamentally wrong with this picture? Will he stand up on behalf of his elected colleagues in the House of Commons and say the bill has no legitimate right to be in the House of Commons, never mind the points he was making about its relative merits?

[Lawrence Toet, Conservative, Elmwood—Transcona, MB]

Mr. Speaker, I am pleased to rise in my place today to express support for Bill S-4, the digital privacy act, which was first introduced in April of last year. The digital privacy act would make important changes to Canada's private sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, to better protect the privacy of Canadians.

I would like to spend my time highlighting the measures in Bill S-4 that are designed to better safeguard the privacy of minors and protect vulnerable members of our society. In our modern digital economy, it is absolutely critical that we make sure our children have safe and secure access to online resources.

Being digitally literate is no longer merely nice to have; it is now a necessary prerequisite for young Canadians, whether to be successful in school or to find their first job. In fact, a recent survey revealed that in 2013, 99% of Canadian students were able to access the Internet outside of school.

While there are many benefits to being digitally connected, going online can also expose our children to risks. As we have unfortunately seen, young people can become targets of online intimidation and abuse. Our government has acted to protect our children from cyberbullying and other similar threats through Bill C-13, the Protecting Canadians from Online Crime Act. This bill, which came into force on March 9, 2015, ensures that all Canadians can freely access the Internet without fear of victimization.

Bill C-13 protects children and adolescents from online predators and exploitation. Provisions of the bill permit and empower the courts to penalize those who harass, intimidate, exploit, or threaten others online or through telecommunication devices. In other words, Bill C-13 serves to counter cyberbullying in Canada.

The Government of Canada takes cyberbullying very seriously and supports a no-tolerance framework. In January 2014, our government launched the anti-cyberbullying national awareness campaign called Stop Hating Online, which raises awareness of the impact of cyberbullying and how this behaviour amounts to criminal activity.

We have also taken further steps to protect children from online predators. Our government has invested $14.2 million a year through the national strategy for the protection of children from sexual exploitation on the Internet. In addition to Bill C-13, our government has implemented other concrete measures to keep young Canadians safe online and in their communities. Such measures include increasing the maximum penalties for luring a child online, strengthening the sentencing and monitoring of dangerous offenders, and strengthening the sex offender registry, to name only a few. All of these initiatives align with our government's commitment to stand up and protect Canadians.

Bill C-13 was introduced to provide a safe and secure environment for Canadians online, and the digital privacy act seeks to accomplish this as well. In this rapidly growing digital world, we must be aware that going online can expose vulnerable Canadians to privacy risks. For example, minors can be subject to aggressive marketing tactics or can have their personal data collected and shared without them truly understanding what is being done and the potential long-term privacy consequences.

To address this concern, the digital privacy act includes an amendment to clarify requirements for the collection, use, and disclosure of personal information. Specifically, the bill clarifies that when a company is seeking permission to collect, use, or disclose personal information from a group of individuals, such as children, it must take the necessary steps to ensure that, as a group, these individuals are able to understand what would happen to their personal information. In practice, this means that the organization's request for information must be presented in a clear and concise manner and must be appropriate for and easily understood by the target audience. This includes making sure the wording and language used in the request are age-appropriate.

Let me take a minute to give an example explaining to the members of the House how this would work. Let us say that an online service designed for children wishes to gather information about who visits their site. In order to seek consent, the company would be required to design and present its request to collect, use, and disclose information using language that a child could reasonably be expected to understand. If a child could not be expected to understand what the website seeks to do with their information, the child's consent would not be valid. As a result, consent from a parent would need to be sought.

The Privacy Commissioner expressed his strong support for this amendment when appearing before the standing committee. This is what the Privacy Commissioner said:

I think with the clarification that Bill S-4 provides, it is a useful clarification of what consent is, and it has the potential of improving the situation for the issue of consent sought from children....

There are additional amendments in Bill S-4 that are also designed to better protect the interests of other vulnerable individuals. I would like to bring to the attention of hon. members two particular amendments that would allow information to be more easily shared in emergency situations.

The first of these amendments would allow organizations to share personal information in order to contact a family member of an injured, ill, or deceased individual. The importance of this amendment was well summarized by the representative of the Canadian Pharmacists Association in her appearance before the standing committee when she said:

Pharmacists, as well as any health care provider, may find themselves in the difficult situation of having to deal with patients who may be severely ill, unconscious, or incapacitated for any number of reasons. In such circumstances it may be imperative for the pharmacist or other health professional to immediately contact family members or next of kin to inform them of the patient's condition, or to seek valuable information on the patients' medical history. But seeking permission or consent to contact those individuals in advance may simply not be reasonable nor in some cases possible. This clause would provide pharmacists and other health care providers with the comfort and knowledge that in the case of a severe health emergency they will not be in contravention of PIPEDA for acting in the best interests of their patients by contacting next of kin or authorized representatives.

The second of these amendments would allow information to be shared in situations such as accidents or disasters, in order to assist in the identification of injured, ill, or deceased individuals. For example, this would allow dentists to provide an individual's dental records to authorities in order to identify victims of a natural disaster.

These two amendments are clearly in the public's interest and are long overdue.

The government is committed to protecting the privacy of Canadians. The digital privacy act would take necessary actions to protect the most vulnerable members of our society, including children.

The House resumed consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as reported without amendment from the committee, and of the motions in Group No. 1.

[James Bezan, Conservative, Parliamentary Secretary to the Minister of National Defence]

Mr. Speaker, it is my pleasure to be here today to express my strong support for Bill S-4, the digital privacy act. This bill would make significant and long-overdue improvements to Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA.

One question that has been asked repeatedly by members opposite is why the government is not amending PIPEDA in response to the Supreme Court of Canada's decision in Canada v. Spencer. They claim they cannot support the digital privacy act because the bill fails to act on this decision. Those are very strong words and it is clear that the opposition parties have not done their homework before speaking on this matter.

The answer to their question is quite simple. The government is not proposing amendments to PIPEDA in response to the Spencer decision because the Supreme Court confirmed that PIPEDA does not give the police any search and seizure powers. In fact, the whole purpose of the law is to increase the protection of Canadians' personal information.

Given the questions that have been raised around the Spencer decision, it is important that I take time today to clear up some of the misinformation. My hon. colleagues opposite do not need to take my word for it. They can always take the time to read paragraphs 71 and 73 of the decision themselves. The Spencer decision deals with a child pornography investigation carried out by the Saskatoon police department. As part of the ongoing investigation, police identified the IP address of a computer that was being used to access and distribute child pornography.

It is important to understand that the police were able to obtain the IP address simply by going online and interacting with the child pornographer, because computers make their IP addresses public whenever they engage in a file-sharing activity. With this IP address in hand, the police then asked the Internet service provider to voluntarily provide account information for the subscriber assigned to the IP address. The account information included the subscriber's name and mailing address. The police asked for the service provider's co-operation on the good faith belief that the subscriber did not have a reasonable expectation of privacy with respect to his or her basic account information, which is the individual's name and address.

With this information in hand, the police obtained a warrant to search the suspect's house, at which time a computer was seized and found to contain child pornography. Mr. Spencer was charged and convicted of possession of child pornography. Mr. Spencer appealed his conviction on the grounds that he had a reasonable expectation of privacy with respect to the account information obtained by the police. In other words, he argued that the police were required to obtain a warrant before getting his basic subscriber account information from his Internet service provider to make sure that his charter rights were respected.

In its decision, the Supreme Court found that Canadians in general have a reasonable expectation of privacy with respect to their Internet browsing habits and history. This is because the sites we visit and the online activities we engage in can reveal “intimate biographical details” about ourselves, details that we may wish to keep private. Because linking an IP address with a specific account holder enables the police to learn about and observe an individual's Internet habits, the court found in the specific circumstances of the Spencer case that the police should have obtained a warrant from a judge to collect Mr. Spencer's account information.

It is, however, important to note that because the police were acting in good faith, believing that Mr. Spencer did not have a reasonable expectation of privacy in his account information, the court did not exclude the evidence obtained by the police and Mr. Spencer's conviction was upheld.

These are the facts. It is difficult to see how this decision means that PIPEDA, the digital privacy act or Bill S-4 in some way violates the charter rights of Canadians, as the members opposite have asserted at every opportunity. This is blatantly false.

As I stated at the outset of my remarks, the Supreme Court confirmed that PIPEDA does not create any search and seizure powers for law enforcement. Nothing in the law compels companies to provide personal information to law enforcement and the digital privacy act would not change that fact.

Justice Cromwell stated in his decision, “In short, I agree with the Ontario Court of Appeal...on this point that neither...the Criminal Code, nor PIPEDA creates any police search and seizure powers”.

He said, “PIPEDA is a statute whose purpose” as set out in section 3 “is to increase the protection of personal information”. Justice Cromwell further clarified that there are clear restrictions that PIPEDA places on disclosures by private businesses to law enforcement agencies. He stated that even in child pornography cases, the circumstances “cannot override the clear statutory language of...PIPEDA, which permits disclosure only if a request is made by a government institution with 'lawful authority' to request the disclosure”.

This fact clearly demonstrates that PIPEDA prohibits unlawful disclosure unless the requirements of the law are met, including that the government institution demonstrates the necessary authority to obtain, not just simply to ask, for the information.

In addition to a warrant or court order, what might this lawful authority to obtain information include? Justice Cromwell stated:

“Lawful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law.

Justice Cromwell clearly noted that issues of disclosure and lawful authority arose in this case simply because the investigation was begun by police. This is simply not the case for private organizations. In his Supreme Court decision, Justice Cromwell wrote that, “...entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police”.

To summarize, this is what the Supreme Court said about PIPEDA in the Spencer decision.

PIPEDA does not provide law enforcement with any “search and seizure powers”.

Consistent with the charter, PIPEDA permits businesses to disclose personal information to law enforcement without consent in only the following circumstances: law enforcement have a warrant or a similar court order; the information is required to address an emergency, such as information that is needed to stop a crime in progress that threatens someone's life; the law enforcement agency is acting pursuant to a specific law that gives it the authority to obtain private information without a warrant; in response to a routine inquiry by law enforcement regarding information for which there is no reasonable expectation of privacy; or the organization, on its own initiative, provides the information to police to report a crime.

Clearly, the Supreme Court did not find any part of PIPEDA unconstitutional.

I hope that with this clarification, all hon. members will join us in supporting the digital privacy act Bill S-4, the digital privacy act, in ensuring that Canadians' personal information is protected.

[Jasbir Sandhu, NDP, Surrey North, BC]

Mr. Speaker, I rise in the House today on behalf of my constituents from Surrey North to speak on Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act. I rise today because I oppose the bill in its current form.

Members from three parties proposed amendments to the bill so that it would stay within constitutional boundaries. However, the Conservatives rejected every single one of those amendments, even the amendments that were drafted according to the comments and suggestions from the witnesses.

As the official opposition, it is essential that we carefully review the legislation and voice dissenting opinions in order to ensure that each bill is thoroughly examined. In this case, as in most cases that I have experienced in the past four years, it is evident that the Conservatives are determined to push through their own agenda on their own timeline.

I feel strongly that it is important for Canadians to know that their privacy is being protected, especially in the digital age that we live in. However, just because the Conservatives have not conducted the mandatory five-year review of the Personal Information Protection and Electronic Documents Act, PIPEDA, does not mean that we should rush through an unbalanced bill.

I feel very strongly that the bill before us was not well studied and needs to be fixed before it is passed through the House. In fact, the Conservatives did not support or submit any amendments to the bill because they did not think that would allow enough time to pass the bill before the election. This sounds politically expedient to me. Canadians deserve better than what the Conservatives are giving them.

The issues surrounding online privacy and safety are not new problems. Rather, they are existing problems that have become increasingly harder to protect against as technology continues to advance. Therefore, given the changing nature of the problem, it is important that the legislation that we create also evolves.

I am glad that after so many years of inaction, we are finally considering legislation to address online privacy issues. My colleague, the member for Terrebonne—Blainville, tried to take action to protect Canadians' privacy back in 2012 with Bill C-475. Unfortunately, that bill, which was stricter and more effective than the bill before us although very similar to it, was voted down by the Conservatives.

The Conservatives have become very good at pretending they know how to do their jobs and protect Canadians. They are actually able to stand up in this House and lie through their teeth in saying that this is a balanced bill, and they believe that.

Online privacy and security breaches have the potential to significantly harm an individual. Protecting these rights is important for all Canadians so that we do not put anyone potentially in harm's way.

Some Canadians may feel that the bill does not affect them in their daily lives, but I can assure them that Bill S-4 would affect every single Canadian.

One part of the bill that I am very concerned about pertains to the sharing of our personal information. The bill contains a provision that would make it easier for companies to share our information without our knowledge or consent, without a warrant, and with zero oversight. It is troubling to me that there is no mechanism in place for oversight.

Do the Conservatives remember the ruling in Regina v. Spencer? I do. In this decision, the Supreme Court of Canada ruled that Canadians have a reasonable expectation of privacy online. More specifically, the Supreme Court stipulated that spyware data cannot be disclosed to a third party without a warrant.

In light of this decision, it is questionable whether certain provisions in Bill S-4 are even constitutional. There are limits on what the government can do, but the Conservatives seem to have forgotten that.

We are demanding that every clause pertaining to the warrantless disclosure of information be withdrawn out of respect for the Supreme Court ruling and the privacy of Canadians.

There is no doubt that the Conservatives have a dark past when it comes to protecting personal information, and this bill would only add to that darkness. The lack of oversight and the allowance of warrantless disclosure has led to 1.2 million secret requests from Conservative government agencies for personal information from telecommunications companies in one year alone. Under the current Prime Minister, staggering numbers like this show that something needs to change, and it starts with this bill.

The Conservatives' hesitation to accept amendments to this bill makes me question whose interests they are truly protecting. Are they protecting the interests of Canadians, who deserve to trust that their personal information will be protected, or are the Conservatives protecting their own self-serving interests?

We would like to see this bill contain a mandatory data loss or data breach reporting mechanism. However, the bill in its current form would most likely result in fewer breaches being reported. It would be up to the organization that suffered the breach to determine if the breach posed a real and significant risk of harm. Companies want to save their reputation and money, so why would they inconvenience themselves by reporting a potentially embarrassing breach of privacy that could cause consumers to lose trust in them when they could just hide it instead?

There would be no incentive to report a breach and no advantage to doing so. This is a conflict of interest that would deprive Canadians of the information that they need to make informed choices about which companies they decide to share their personal information with.

Furthermore, because of the Conservatives' inaction, PIPEDA, which is supposed to be updated every five years, is falling far behind international standards. Since the first statutory review in 2007, subsequent attempts to amend PIPEDA have died on the order paper. After this long wait to update PIPEDA, the bill would simply not go far enough to protect Canadians in this digital era. We as Canadians are getting the message that the government does not take the protection of personal information seriously.

I, along with my fellow NDP members, truly do not ask for much when it comes to this bill. We have long called for the modernization of Canadian privacy laws. They are not up to date. Instead of making it easy for companies to share our information, the government should put deterrent penalties put in place that would require or encourage these private companies to respect and follow Canadian laws. Following that, we insist that the provisions in Bill S-4 to allow organizations to share personal information without consent or a warrant be removed and that the loopholes in PIPEDA, which do the same thing, be closed.

The point of the Constitution and the Canadian Charter of Rights and Freedoms is to protect the very rights and freedoms contained within them. Warrantless access to our subscriber data and personal information most definitely poses a risk to Canadian privacy.

Modernizing the laws that govern the protection of personal protection is an important issue in the digital age. However, ramming through a bill that has huge holes, such as this bill, is not a fix that can make up for years of inaction by the current government. I urge the Conservatives to accept the amendments to this bill so that we can work collaboratively to ensure that all Canadians can trust that their personal information is being protected to the best of the government's ability.

One of the other things that was very troubling was seeing time allocation moved for the 97th time. Time allocation basically puts closure on this bill. It does not allow for all of the members to bring the views of their constituents into the House, which is one of our primary jobs.

This is the 97th time the Conservatives have done it and I can assure you, Mr. Speaker, they are not going to get the chance after October 19, because Canadians are tired. They have seen democracy and the workings of democracy crumble. These guys are going to be out.

[Paulina Ayala, NDP, Honoré-Mercier, QC]

Mr. Speaker, on June 2, 2014, the Supreme Court of Canada handed down an important decision about sharing personal information.

In their decision, the Supreme Court justices stated that information about customers, including their names, addresses, email addresses, phone numbers and IP addresses, could not be shared with a third party without a warrant.

In light of that decision, does the member believe that some of the provisions in Bill S-4 might not be constitutional?

[Michelle Rempel, Conservative, Calgary Centre-North, AB]

Mr. Speaker, as I mentioned in my speech, the changes in this bill affect private investigations, which, as the bill defines, are investigations carried out by a private sector organization, not a government authority.

With regard to the Supreme Court decision, the Supreme Court itself noted that PIPEDA does not create any search and seizure powers for law enforcement; instead, it allows companies to provide information to police should they choose to do so when—and here is the kicker—the police are legally able to obtain the information, meaning through normal warranting procedures.

The court has clearly stated that this is only when police have a warrant, are acting in exigent circumstances, are acting under an authority granted to them in law, or are obtaining information for which there is no reasonable expectation of privacy.

The Supreme Court decision itself clarifies how PIPEDA works, and it does not mean how the act or Bill S-4 needs to change.

I hope that my colleague will inform himself. I know he is well informed on this bill. He certainly knows the ramifications of the Supreme Court ruling in this regard. I hope that he would actually provide the correct information to his constituents and to folks abroad about this. Indeed, as the member for Terrebonne—Blainville said on April 8, 2014, “We have been pushing for these measures and I'm happy to see them introduced.”

This is something that supports all Canadians and is a common sense measure to help strengthen our legal system.

[Michelle Rempel, Conservative, Minister of State (Western Economic Diversification)]

Mr. Speaker, I am pleased to rise to speak on behalf of Bill S-4, the digital privacy act, which is referred to the House by the Standing Committee on Industry, Science and Technology.

When Parliament first enacted the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, in 2001, it recognized there were certain limited circumstances in which an individual's right to privacy must be balanced with other fundamental rights and public interest.

One such interest is the need for investigations into breaches of agreements, contraventions of law and for fraud prevention, which in certain circumstances must be conducted by the private sector.

Examples of these are common. They include investigations into professional misconduct by self-regulating professional associations, like the provincial colleges of physicians and surgeons, as well as the law societies. Another example is cross-sector investigations to detect crime and prevent fraud, such as the work done by the Bank Crime Prevention Centre and Investigation Office of the Canadian Bankers Association and the investigative services division of the Insurance Bureau of Canada.

It is not difficult to see that there is a real public interest in ensuring that these organizations have the ability to investigate. In order to do so, they must be able to obtain personal information that is protected under PIPEDA.

The Privacy Commissioner told the committee:

I totally agree that there needs to be provision in PIPEDA allowing organizations to address the issue of fraud or breaches of agreements that they may face.

The need for such a provision is also recognized within the legal community. The committee heard from Eloise Gratton, leading privacy officer and partner at the law firm of Borden Ladner Gervais and a professor of law at the University of Montreal. Ms. Gratton spoke of her own experience as counsel to private organizations conducting investigations into wrongdoing. She said:

The bottom line is that I agree that we need to have a provision authorizing the disclosure of personal information without consent to address these types of situations.

To enable this type of information sharing, PIPEDA currently has a regime that allows organizations to disclose an individual's personal information in order to conduct certain types of investigation.

As it stands right now under the current law, investigators who want to access personal information must be listed as an investigative body in the regulations. This involves coming forward with an application to the government and if the federal cabinet decides that the application is warranted, the organization is added to the list.

This is an extremely burdensome process for organizations. During the first parliamentary review of the act in 2007, the Standing Committee on Access to Information, Privacy and Ethics recommended that this system be scrapped and replaced with a different set of rules based on those that had been in place for a decade in Alberta and British Columbia. The bill would implement this recommendation.

A number of witnesses who came forward at the committee to express support for the importance of the changes within the bill expressed many positive sentiments in this regard.

The Life and Health Insurance Association of Canada told the committee that these amendments would help the industry's effort to detect, deter and minimize insurance fraud, which is stated to be extremely costly to the industry. A witness from the association explained to committee members that there was a current gap in PIPEDA to which he said:

[It] restricts the ability of organizations to disclose information without consent...for the purpose of conducting an investigation into a breach of an agreement or of a law of Canada.

The Central Credit Union of Canada also testified that it supported the proposed exception for consent for fraud prevention. In the words of the Central Credit Union witness it would:

—reduce the administrative burden associated with some of the activities of...my organization's Credit Union Office for Crime Prevention and Investigation.

Finally, the Insurance Bureau of Canada also spoke to the importance of the proposed amendments for the investigation and prevention of automobile fraud. According to Insurance Bureau statistics, automobile fraud cost the Ontario economy an estimated $1.6 billion in 2014 alone.

The witnesses from the Insurance Bureau explained in detail to the committee how Bill S-4 would make an insurance crime easier to detect and prevent as a result of the changes our government was making, and this is great news. However, I should note that during the committee's review of the bill, some concerns were expressed about the potential for misuse of such an exception to consent or resulting in the over-sharing of personal information, as my colleagues opposite have noted today.

However, the bill would protect against this aspect. Organizations can only make use of the exception to consent when a four-part test is met.

First, the disclosure must be made to another private organization, not to the government or to law enforcement. Disclosure to government authorities must follow a different set of rules, for example, when police must obtain a warrant to get private information.

Second, the exception to consent is only available if the information is being shared for the purpose of conducting an investigation into a breach of Canadian law or a breach of an agreement, such as a contract, and it must be reasonable. This means that an average Canadian must be able to see the merit of disclosing the information in question for the purposes of an investigation.

Third, the investigation has to be legitimate. It must pertain to a contravention of law or a breach of agreement that has occurred, is occurring or is imminent. Information cannot simply be disclosed because an agreement might be broken.

Finally, it must be reasonable to believe that seeking the consent of the individual in question to disclose the information would compromise the investigation, for example, by allowing them to destroy or alter evidence.

The intention of this four-part test is to allow legitimate investigations that are in the public interest to take place in a manner that is being balanced with an individual's right to privacy.

My colleagues have brought up the issue of copyright trolling. Certain concerns have been raised that copyright lawyers could abuse the amendment to target Canadian consumers. Let me be clear. This type of activity is not an investigation. Nor is it fraud prevention. Under no circumstances do we believe this proposed amendment provides a backdoor that could be used for trolling, due to these tests. PIPEDA has always provided a legal certainty with respect to the rights of legitimate private sector investigations. Bill S-4 maintains that legal certainty.

I also want to touch on a couple of comments that have been made in light of the bill.

First is the definition of “significant breach”. There has been some doubt as to what this means. As set out in the bill, a significant breach is a breach that poses a real risk of significant harm based on the sensitivity of the personal information involved in the breach, the probability that the personal information has been, is being, or will be misused and any other factor prescribed in the regulations.

The definition of “significant harm” was also brought up. It is defined in Bill S-4 as bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record or damaged or lost property.

There was also some doubt about “private investigation”. It is defined as an investigation carried out by private sector organizations, therefore, not a government authority into an alleged contravention of a Canadian law, or an alleged breach of agreement.

Since we are getting to the end of this session of Parliament, should I not have an opportunity to rise again in debate in the next few weeks, I would like to thank all of my constituents in Calgary Centre—North for the privilege of allowing me to serve them in the last four years, as well as my volunteer team and certainly, in a moment of non-partisanship, my colleagues across the aisle and in the House who every day travel away from their families to spend time in the honour of public service. This is not a job. This is service. Certainly, when we all rise here in debate to discuss these issues, we might be passionate opponents one way or the other but we all do it to build a better Canada.

It is a wonderful position to be in to rise to support bills like this, which are common sense measures to make Canada a better place, to support better legislation, better privacy, better access to information and strengthening Canadian laws. These are the things with which we as parliamentarians are often seized.

It is always a great pleasure to speak in this place and it is a great pleasure to be here as a parliamentarian.

[Matthew Dubé, NDP, Chambly—Borduas, QC]

Mr. Speaker, I am pleased today to speak to the very important Bill S-4. It concerns the sharing of personal information in the digital age. It deals mainly with the way in which we legislate against companies responsible for the loss or sharing of information. We know this is a very sensitive issue because we are in the digital age where more and more personal information is found online. We think first of banking information, and also of information that sometimes seems not that important, but that is nevertheless part of peoples' private lives. It is information that we share on social networks, such as photos.

This covers all kinds of of complex issues, such as copyright, that we have addressed in the House since the last election, and the dissemination of information pertaining to national security. We had an important debate on this issue during the debate on Bill C-51. We learned that information technology companies, or startups, had concerns about some of the bill's provisions.

Of course, we are all familiar with the infamous story of Bill C-30, where the minister of public safety and emergency preparedness at the time told us that we stood either with the government or with child pornographers. This example shows just how big an issue we are dealing with and the Conservatives' poor record in this regard.

First, I would like to mention something very important and very simple: the obligation to review the privacy legislation every five years. Obviously, this is very important given how quickly technology changes. Unfortunately, such a review has not been implemented. A number of bills were introduced in this regard, but they died on the order paper when the Prime Minister prorogued Parliament. There was, of course, Bill C-30, which is a whole other story, and there was also the bill introduced by my colleague from Terrebonne—Blainville. That bill, which the government refused to support, sought to implement a robust privacy review process, give more power to the Privacy Commissioner and have clearer legislative provisions.

Bill S-4 includes similar provisions. However, they do not go far enough and there are still worrisome loopholes. One of the grey areas that I am particularly concerned about has to do with organizations, such as banks, that could share private information. These organizations are required to report a loss of personal information to the Privacy Commissioner only “if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”. That may seem clear, but when it comes to legislative measures, we can see that there is a lot of leeway in how this provision of the bill is worded. The company could decide that no one's privacy was really violated and that there was no risk of harm to the individual and simply not report the privacy breach.

One of the flaws in this bill is the requirement for a court warrant, which my colleague from Terrebonne—Blainville brought up earlier and which she included in her bill. The Supreme Court recently ruled that any invasion of privacy by the government and any request that the government makes to a private company that is in possession of our information require a mandate. There is no such requirement in this bill, which is extremely worrisome. That is why I made the link earlier to Bill C-51 and the debate on Bill C-30, which did not end up taking place because we managed to get the government to back down. The government seems to be on the wrong track and does not seem to take privacy seriously.

Its record is a great example of that. How many times does the House need to hear criticisms about mismanagement at the Canada Revenue Agency, for example, during question period or at every possible opportunity, whether it is when bills are introduced and petitions are presented or at press conferences?

This department is in possession of the most sensitive information on Canadians, such as their social insurance numbers and their tax information. The department has been the victim of data breaches, and the government does not seem to be taking any responsibility. That makes it hard for us to trust that the government will require private companies to comply with high privacy standards when it is not capable of doing so itself. This situation is extremely worrisome.

We know that this is a complex issue because more and more things are done online. As far as matters of national security are concerned, we know that as legislators we have work to do. We wanted to propose amendments to ensure that this bill went further and complied with the Supreme Court decision. Like a number of witnesses in committee, we question the constitutionality of this bill in its current form.

If I am not mistaken, the 18 amendments the NDP proposed were all rejected. True to form, the Conservatives did not listen to any of the testimony or pay any regard to the amendments proposed by all the parties. The amendments proposed by the NDP were all based on what the public had to say and on the very hard work of my colleague from Terrebonne—Blainville, who was trying to get suitable provisions for 2015, not 2000. Technology changes and so does our reality, and we have to adjust accordingly.

In this context, there are a number of troubling aspects. First, this bill was introduced in the Senate, which, naturally, we criticize every chance we get. The Minister of Industry made an announcement about how he wants to proceed in the digital age, but instead of introducing this bill in the House himself, he introduced it in the Senate. That is one problem.

The second problem is that the Conservatives wanted to skip second reading and send the bill straight to committee. That is not a bad idea in and of itself. The NDP has asked for the same in order to study certain extremely complex files.

For example, we asked to take this approach for Bill C-23, which we called the “electoral deform” bill. Since the government wanted to go straight to committee, we thought it was willing to accept amendments and listen to witnesses, but that did not happen.

The third problem concerns another of the government's bad habits: the honour of the 97th time allocation motion was bestowed on Bill S-4 in order to limit debate. Unfortunately, at this rate, the Conservatives will have moved 100 such motions by the time the election is held. To be blunt, that is pretty shabby.

Although it is important to protect Canadians' privacy and to do what it takes, in 2015, to implement an approach appropriate for the digital age, recent Supreme Court decisions have cast doubt on the constitutionality of this bill.

This bill does not go far enough, and since the government wants to limit debate and does not accept the amendments and the work done in committee, we cannot and will not support this bill. I am very pleased to rise in the House to say that.

The House resumed from May 12 consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as reported (with amendments) from the committee, and of the motions in Group No. 1.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

I would like to support my colleague's motion to increase the funding for those three commissioners. When they testified last week, they told us they were making as many cuts as possible, but that they have run up against a wall. Their current funding no longer enables them to fulfill their mandate.

The Office of the Information Commissioner even went through a crisis. At the end of last fiscal year, the commissioner made an urgent request for a funding increase. She had only 0.2% of her budget left. She was worried, not about her office, but about Canadians' right of access to information. I repeat that the right is quasi-constitutional. By failing to allocate our commissioners the funding that enables them to continue to operate and do everything their mandate requires, we are letting Canadians down. That is the key issue.

The Privacy Commissioner, who has been assigned new responsibilities, told us that he was managing for now, but that he could not get through another fiscal year after the implementation of Bills S-4 and C-51. Many bills directly affect his activities. He will be asked to carry out more and more tasks with less and less funding, and that's unreasonable. He said that he could not go on much longer with the current funding. The Lobbying Commissioner also said that it was becoming increasingly difficult for him to deliver on his mandate with the funding he receives.

In closing, I would like to say that the commissioners are there to implement an accountability system, so that someone oversees our actions as parliamentarians, and those of lobbyists, and to ensure that regulations and acts are being complied with. Their actions are being limited when they are not given an opportunity to carry out their activities properly. It's as if we were saying to those tasked with overseeing us that we no longer want their oversight. It is really disgraceful.

I would really like us to give serious consideration to this motion and not to cast it aside as we have others. As my colleague said, I think it would be good for the future Parliament to provide the commissioners with the funding they need to deliver on their mandate properly.

Thank you.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, when it comes to reducing taxes everyone knows these are Conservative ideas and Conservative proposals. In fact, when we reduced the GST from 7% to 6% to 5%, saving Canadians billions of dollars, the NDP voted against that measure to benefit Canadians. Therefore, we know who is delivering on lower taxes for Canadians.

This afternoon we will start the report stage of Bill S-7, the zero tolerance for barbaric cultural practices act. Needless to say, I am disappointed to see on today’s notice paper some 17 report stage amendments, which, all told, would eviscerate the content of the bill. From these proposals, the opposition are clearly signalling that they do not support this Conservative government’s efforts to send a strong message to those in Canada, and those who wish to come to Canada, that we will not tolerate cultural traditions that deprive individuals of their human rights. Early and forced marriages, “honour”-based violence, and polygamy will not be tolerated on Canadian soil, so Conservatives will be voting against all of these opposition amendments.

Tomorrow, we will resume the third reading debate on Bill C-42, the common sense firearms licensing act. I am optimistic we can pass the bill soon so the Senate will have adequate time to consider these reductions in red tape, which regular, law-abiding Canadian hunters, farmers and outdoor enthusiasts face.

Monday shall be the sixth allotted day. The New Democrats will provide a motion for the House to debate when we come back from a weekend in our constituencies.

We will complete the report and second reading stages of Bill S-4, the digital privacy act, on Tuesday. Earlier today, the House heard my colleague, the Minister of Industry, explain the importance of this key legislation.

Wednesday, we will see the House return to the report stage of Bill S-6, the Yukon and Nunavut regulatory improvement act. This legislation is clearly both needed and wanted north of 60. Bill S-6 would modernize regulatory regimes up north and ensure they are consistent with those in the rest of Canada, while protecting the environment and strengthening northern governance.

Next Thursday, June 4, will be the seventh allotted day, when the House will again debate a topic of the New Democrats' choosing.

Finally, for the benefit of those committees studying the supplementary estimates, I am currently eyeing Monday, June 8 as the final allotted day of the supply cycle. I will, however, confirm that designation at this time next week.

Bill S-4--Time Allocation Motion

[Blaine Calkins, Conservative, Wetaskiwin, AB]

Mr. Speaker, I certainly appreciate the comments the minister has made. I will just use my time to ask a substantive question about the piece of legislation.

When I sat on the ethics and privacy committee for a number of years, we did have substantive debates about these kinds of issues. We have had previous versions of this legislation, which has come forward in previous sessions of this Parliament.

I am very glad to see the government moving forward in getting the bill passed. It has already been through the Senate and is now here in the House. We have the opportunity to have this debate and get this legislation passed in a timely fashion.

As a parent, something that concerns me is the amount of time my children spend online and the lack of rules and regulations in some instances that we know are there, some of the risks and some of the issues that are online, and the lack of clarity and the lack of standardization. We know full well some of the issues that pertain to that.

I am wondering if the minister could speak to how Bill S-4 actually improves the online world insofar as protecting young people, vulnerable people, and especially children.

[Laurin Liu, NDP, Rivière-des-Mille-Îles, QC]

Mr. Speaker, I would like to correct some of the false information the minister has spread. First, he said that we had enough time to debate Bill S-4 on Canadians' privacy. Unfortunately, we had just one day to debate this very complex bill that Canadians consider controversial. We have unfortunately not had enough time to study this bill thoroughly in the House.

In his speech he showed contempt for the official opposition. He is wrong: all of the recommendations were proposed by the official opposition. This is not how our Parliament should work. He also mentioned the Information Commissioner. There has been a flagrant lack of respect for the Information Commissioner during this Parliament.

Not only did the government not accept any of the recommendations that the Information Commissioner made during the study of Bill S-4, it also prevented the Information Commissioner from testifying before the committee during the study of Bill C-51, a bill that, as we all know, is even more controversial than Bill S-4.

This is the 97th time they have invoked closure in the House of Commons. That is not something to be proud of. The government keeps breaking records when it comes to gag orders in the House.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, I completely disagree. That is what we did with Bill S-4. We had a very respectful and serious debate. We spoke about this bill in depth and talked about the implications of a bill as complex as this one.

In the debate in the House and in committee, and outside the House of Commons, we have had respectful exchanges with the government's partners that are affected by this bill, such as lawyers, representatives of the private sector and the Privacy Commissioner. We carried out analyses, we took part in debate, and presentations were made to the government. We made decisions after truly listening to the people who had concerns about the status quo.

We listened to them and that is why the chamber of commerce, former privacy commissioner Chantal Bernier and Daniel Therrien support this bill. I have a long list of people who support the bill. A large group of Canadians pointed out that our government listened. We did our analyses, we did our homework and we came up with a balanced bill that not only meets the interests of our commercial and electronic future and Canadians' needs, but also meets the government's need to have a really effective bill on Canadians' privacy.

That is what we did. There was debate here, in the House, at committees and outside the House of Commons, before we introduced the bill and while it was before the House. We continue to follow an approach that is democratic and effective, as part of a process that truly achieves results.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, as the Speaker and a member of the House of Commons, you are well aware that this is always a very important discussion to have at the beginning of each Parliament.

In the future, it will be very important for every one of us to discuss the serious nature of our work in the House of Commons and the way that we are all going to participate in debate that is respectful to our constituents. We need to have that conversation not just here in the House, as an institution, but also within our political parties.

That discussion will be even more important when the number of seats in the House of Commons goes from 308 to 338 this fall. This is always a topic of discussion within the parties, particularly with regard to the House of Commons.

In my opinion, our government is very serious about meeting the needs of Canadian taxpayers and having effective and respectful debates about the content of our bills. That is what we have done with Bill S-4.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, the fact remains that half the legislative process in the Parliament of Canada is conducted in the Senate. I know that the NDP wants to abolish the Senate. However, the Supreme Court says that that is impossible, so the NDP's policy is clearly pointless. Bill S-4 did originate in the Senate, but that is because we wanted an efficient approach to the process in order to ensure that both houses of Parliament would have the time needed to do their homework and act responsibly with regard to a bill as complex as this one. That is why we took this approach.

Certainly, in legislation as important as this, the personal information protection and electronic documents act reform, Bill S-4, which is quite technical, it is important that we have a thorough process. It is mandated that Parliament do this review and, as Minister of Industry, it is my responsibility.

I know the industry committee did a thorough study of this. We had all kinds of views that were incorporated prior to us tabling legislation, during the legislative process and deliberation at the committee stage. It happened on the Senate side as well. This legislation is something of which I am quite proud. It is very important for our country. Reporting of data breaches, accountability, the implication of support of the Privacy Commissioner with regard to data breaches, the penalties that are in place for firms that do not inform people about data breaches that take place, all are important. This would be a big step forward for Canada.

Again, it was arrived at after a great deal of consultation, in a non-partisan way, to draw in ideas. We arrived at legislation that would strike an effective balance. When the legislation is adopted and moves forward, the country will be very well-served.

[Françoise Boivin, NDP, Gatineau, QC]

Mr. Speaker, I find it interesting that the Minister of Industry is talking about a Parliament that will have 338 members. It is difficult enough to speak with 308 members in the House. I am not looking forward to what will happen when there are 338 members. My colleague should not be proud in the least about a 97th time allocation motion, a gag order to prevent members from speaking, in this case at all stages. This 97th time allocation motion is really one of a kind.

We are hearing that the committee's work was short-circuited and that no proposals were accepted. The exercise of democracy is at stake on the eve of an election campaign that is going to be pretty tough for the government, according to what we are hearing on the ground.

Is he not concerned about how the government is curbing democracy in our country and not just because Bill S-4, as important as it may be, is a Senate rather than a government bill?

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, I know this is a very well-articulated and long-standing concern of the leader of the Green Party on this matter.

With regard to Bill S-4, the time in the House is precious. I personally have the view that I would like to see Parliament sit later into the evenings. Parliament is going to go from a 308-seat House to a 338-seat House, so affording more members of Parliament the opportunity to speak on more bills is an admirable goal. I would hope the Standing Orders in the next Parliament might reflect that.

If we look at other jurisdictions, for example, the U.S. Congress sits very late into the evening, but it also has an approach where it has fixed times for debate of specific bills. It allots to all political parties specific speaking slots and it is done a very different way. Perhaps this conversation needs to be had, given that the House will grow in size by 30 seats this coming fall.

There are other ways in which the government could accommodate, in a meaningful way, people's views on government legislation.

With regard to Bill S-4, which is a technical bill, as well as with the Copyright Modernization Act and other legislation that I have had the responsibility to steer through the House, I suspect the opposition parties would concede that we have tried to approach this in a pretty non-ideological, non-partisan way to draw in opinion from the private sector, from academics and from those who are interested in digital policy and privacy policy to arrive at legislation that would be as effective as possible and would move the country forward in a significant way.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I rise on a point of order and would appreciate your guidance on this, but it is a question of relevance. I understand that the government House leader can at any point rise to put forward such a motion as the one to put time allocation, yet again, on another government bill. However, I find it to be offensive to the principles of examining Bill S-3 to then, in the pretense of speaking to Bill S-3, which is an important piece of legislation to ratify global action on our fisheries, slide into a completely different matter.

On the point of relevance, I think the hon. government House leader should not have pretended to be speaking about Bill S-3 in order to put time allocation on Bill S-4.

Bill S-4—Notice of time allocation motion

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I must advise that an agreement could not be reached under the provisions of Standing Orders 78(1) or 78(2) concerning the proceedings at the report stage and second reading stages and the third reading stage of Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act.

Pursuant to the provisions of Standing Order 78(3), I give notice that a minister of the Crown will propose, at a future sitting, motions to allot a specific number of days or hours for the consideration and disposal of the proceedings at the said stages of the said bill.

[Daniel Therrien]

When the budget remains the same and we are given new responsibilities, such as those we will have to assume in the coming months under Bills S-4 and C-51, a choice clearly must be made. My concern is that we will have to do less in other areas.

I have a specific example. If we were to prioritize monitoring the implementation of Bill C-51 by carrying out investigations and providing government departments with advice, we would have fewer employees available to provide similar advice on immigration, border control and other issues. Some government initiatives would receive less attention because we would have to prioritize Bill C-51.

I would like to be able to do both, as both are important. We will try to do our best with the resources we have and given our new responsibilities. It is certainly possible that we might neglect some other obligations in practice, so we would have to request additional resources to manage to do both.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

That's great. We are looking forward to it. I think Canadians are also looking forward to seeing a bit more transparency around requests for sharing personal information.

In response to Mr. Simms' questions, budgetary constraints were briefly discussed. Your office will eventually have to deal with the implementation of Bill C-51. There is also Bill S-4, whereby your advisory role with companies will increase. Under the legislation, companies are also asked to report privacy breaches to you.

I understand that you are not asking for additional resources today, but that you will eventually. What are your concerns should you fail to obtain more resources?

[Daniel Therrien]

My point is this: we have to deal with complaints, and they're growing. We have a number of means to address them efficiently. That's one side of the picture.

What I'm referring to when I say we have new responsibilities is mostly new statutory responsibilities, under Bill S-4, to receive and advise on reports that we will receive from companies when there are privacy breaches. There is no funding that comes with these responsibilities. Under Bill C-51, we will investigate whether the collection and sharing practices of departments conform with privacy. There is no funding that comes with that.

I'm not asking for money right now. I'm suggesting it's going to be difficult to balance the books with these new responsibilities. Rather than to ask for money at this point, I say we will see, with the experience of implementing these new responsibilities, whether there is a need for additional funding. I think it is extremely possible, but I want to see what history tells us.

[Daniel Therrien]

On the whole, I think Bill S-4 is a positive development. It contains a number of positive aspects, including newly granted enforcement powers. Agreements could be applied more directly. Overall, we feel that Bill S-4 is positive.

I did recommend a few amendments to the bill that were rejected, especially the ones related to legal access and information disclosure to police authorities by telecommunications companies. Of course, I would have preferred it if those amendments were adopted.

That being said, as I indicated as part of the strategic priorities established by my office, since the bill will be coming into force, I intend to strongly encourage public institutions—departments and private telecommunications companies, among others—to produce transparency reports. That way, the public would be able to find out how much personal information those private companies are sending to various police authorities. I hope that will move the debate forward. In light of those facts, some changes might be made in the future.

I am assuming that the bill will be passed as is. I am trying to ensure that the measures to inform the public will be applied as transparently as possible.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I assume it's always good to have as many forums as possible.

I would now like to briefly discuss Bill S-4, which will soon become law. We examined it in committee at second reading. You testified at those meetings. You proposed a few amendments, including to clauses 6 and 7 of the bill. However, those proposals were not accepted, and no changes have been made to the original version of the bill.

Are you worried about the repercussions that may have?

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair. Good afternoon, honourable members.

I am pleased to address our office's main estimates, and with me today are Daniel Nadeau, our chief financial officer; and Patricia Kosseim, our general counsel.

In my time, I will outline our fiscal outlook, describe how we are managing rising demands, and announce our new privacy priorities, which will influence our work in the future.

To begin now, in the coming years, our resources are forecasted to remain at their existing levels. When looking at our 2015-16 report on plans and priorities, there appears to be a drop from the last two fiscal years to this one. This difference is due mainly to the expenses incurred in previous years with the mandatory move of our headquarters in February 2014. Looking forward, for the next three fiscal years, our resources are set to remain relatively stable, at just more than $24 million annually.

That said, we face rising demands. Over the last few years, we have generally seen increasing levels of complaints, while our investigations are becoming more complex. On top of reviewing privacy impact assessments, we are also increasingly requested for consultations to provide advice earlier as new federal initiatives making use of personal information take shape.

Meanwhile, data breach reports from departments were already increasing before a new Treasury Board directive came into force a year ago, making material breach reports to us mandatory. And at the end of the last fiscal year, breach reports in the public sector hit a record high for the fifth consecutive year.

Facing rising demands, we have taken steps to continue meeting our obligations within our existing resources. For example, we are settling more complaints by early resolution, through which parties are satisfied without the need for a full investigation. We are also managing situations where many complaints come from various people about the same issue by opening one all-encompassing investigation. And, we have also implemented measures for situations where one individual submits many complaints, to better balance the needs of all complainants, ensuring all Canadians have access to our services.

All told, Mr. Chair and honourable members, we are using most, if not all, of the tools available under our acts to manage rising demands. But, today, we are left with precious little room to manoeuvre to meet our obligations. We are nearly one year in after taking on new responsibilities under Canada's anti-spam law.

We also anticipate the passing of Bill S-4, which will make breach reports from private sector organizations to our office mandatory. Bill C-51will also create new work for our office as we are called upon to investigate whether its implementation respects the Privacy Act.

So, while I am not ready to say our office needs new resources today, I think it will be quite difficult to meet our existing and new responsibilities with our current level of resources. After we have some experience fulfilling our new roles and a better sense of the impact on our resources, I may need to appear before you to make the case for an adjustment.

Turning to strategic priorities, when I appeared before you to discuss my nomination for the position of Privacy Commissioner of Canada, I said that during my mandate my goal would be to increase the control Canadians have over their personal information.

One of my first initiatives after assuming my role was to launch a priority-setting exercise that would guide the discretionary work my office does towards realizing this vision in the most efficient and effective way possible. As part of this exercise, our office engaged representatives from business, government, civil society, and academia. We also held focus groups to gauge the views of the public. Today, I am pleased to share our results.

To begin, one of our four privacy priorities will be the economics of personal information. Our discussions highlighted the need for user clarity about the personal information they provide in exchange for online services, how that data is used, and the question of meaningful consent. As a result, some of our key work under this priority will be closely examining the issue of consent in today's digital world, increasingly marked by the emergence of big data and the Internet of things.

The overall goal of this priority will be to enhance the privacy protection and trust of individuals so that they may confidently participate in an innovative digital economy.

The “body as information” will be another privacy priority. Whether it is biometric information tied to a trusted traveller card or that generated by medical devices, genetic testing, or wearable fitness trackers, this data may be used in many ways that could compromise people's privacy. This issue concerned the experts we engaged, and it is one about which we will learn more and raise awareness among both developers and users about the potential privacy risks of these new technologies.

The goal of this priority will be to promote respect for the privacy and integrity of the human body as the vessel of our most intimate personal information.

Of course, one of the hallmarks of today's information technology is sharing information with the world in a click, and as the saying goes, “the Net never forgets”, which means youth growing up today may no longer get to outlive their past mistakes. These are among the reasons why reputation and privacy will be one of our priorities, and one under which we will work to help enhance digital literacy among vulnerable populations, while also examining the right to be forgotten.

Our goal with this priority will be to help create an environment where individuals may use the Internet to explore their interests and develop as persons without fear that their digital trace will lead to unfair treatment.

Fourth and finally, government surveillance will also be among our priorities. As mentioned, we will be directing investigative resources to ensure the Privacy Act is duly respected by the information sharing made possible by Bill C-51. We will also give advice to departments, through privacy impact assessments or otherwise, to prevent privacy breaches. We will also work with private organizations and government to establish appropriate standards for transparency in accountability reports.

Ultimately, our goal with this priority will be to contribute to the adoption and implementation of laws and other measures that demonstrably protect both national security and privacy.

In order to make progress on these priorities, we will focus our activities around five cross-cutting strategies: first, exploring innovative and technological ways to protect privacy; second, enhancing accountability and promoting good privacy governance; third, taking into consideration the fact that privacy knows no borders; fourth, enhancing our public education role; and fifth, paying special attention to vulnerable groups.

In closing, our new privacy priorities will help hone our focus to make best use of our limited resources, and further our ability to inform parliamentarians and to protect and promote Canadians' privacy rights. Having identified what we believe are the 21st century's most pressing privacy concerns, our office will now chart a course to address them, in partnership with individuals, organizations, legislators, and fellow oversight bodies.

With that, I look forward to your questions.

Thank you.

Motions in Amendment

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, the committee heard many witnesses. They provided views and testimony from both sides of the spectrum.

It is important to note, as per my colleague's question, that the digital privacy act would require organizations to tell Canadians if their personal information has been lost or stolen. As well, heavy fines of up to $100,000 would be imposed on companies that deliberately break the rules. The legislation would place strict limits on the type of personal information companies can disclose; establish new rules to protect the privacy of vulnerable Canadians, particularly children, as I just discussed; provide provisions to protect seniors from financial abuse, something we have spoken about extensively this afternoon; include measures to allow the use of information to help find missing children; and give the Privacy Commissioner of Canada more power to enforce the law and help hold offenders to account.

Bill S-4 meets those objectives more than adequately.

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, I am pleased to speak to Bill S-4, the digital privacy act, which was recently reviewed by the Standing Committee on Industry, Science and Technology.

Bill S-4 introduces a number of important improvements to the Personal Information Protection and Electronic Documents Act that will increase the level of privacy protection for Canadians.

PIPEDA is privacy legislation that has been in place for more than a decade now. Under the law, organizations are expected to apply stronger protection in situations that are privacy-sensitive. As an overriding rule, businesses must limit what they do when it comes to the collection, use, and disclosure of personal information to activities that one would consider reasonable and appropriate in the circumstances.

Not all individuals have the same capacity to understand what is reasonable and appropriate, nor can they necessarily appreciate the immediate or long-term consequences of providing information about themselves to a commercial enterprise. This is particularly true of minors. The range of online activities today's kids engage in is astounding. They take part in multi-player games with people from all over the world. They explore virtual worlds. They join chat rooms and post comments, photos, and videos about themselves and their friends.

Today's kids have grown up with the Internet and digital technologies. Social networks, gaming consoles, and smart phones have always been a part of their lives. When kids interact with their friends and when they play games, more often than not it is through technology.

According to a survey conducted in 2013, more than 30% of grades 4 to 6 students have Facebook accounts. By grade 11, 95% of students have such an account.

Digital technology offers tremendous benefits to children's education, development, and social lives. In today's digital economy, children must be able to safety and securely use network technologies and access the online world if they are to develop the skills they will later need to find jobs in the digital marketplace.

What children may not be aware of is that the information they share in the context of online play or learning can actually have unintended consequences. Online personal information has become an enormous source of revenue for companies. Kids are able to play online games, download and use apps, and talk to their friends at no cost because companies offering these services generate revenue by harvesting and using personal information for profiling and marketing purposes.

This government does not wish to prevent today's youth from fully realizing the benefits of the digital world. The skills they develop through these many online activities will provide them with significant advantages when they enter the job market as young adults. This government fundamentally believes that digital literacy and skills are at the core of what is needed for individuals to succeed in today's digital economy.

However, with an increased online presence comes added risk. Strong protections for children's online privacy are needed.

PIPEDA already contains defences that safeguard the personal information of minors. For example, the act prohibits organizations from using deceptive means to obtain consent. Most importantly, it requires companies to limit the purposes for which they collect, use, or disclose personal information to reasons that individuals would consider reasonable and appropriate in the circumstances.

Bill S-4 enhances these protections by clearly setting out requirements that organizations must meet when obtaining consent. These new provisions will have a positive impact, especially when it comes to the protection and the privacy of children.

The new measure will require organizations to clearly explain why they are collecting information, what they will do with it once they have it, and what the consequences of providing it will be.

What is more, they must provide this explanation in a way that can be understood by the audience they are targeting with their product or service. This means that any business targeting children must pay very close attention.

The amendments in Bill S-4 mean from a legal perspective that when a company is seeking permission to collect, use, or disclose personal information from a group of individuals such as children, it must take steps to ensure that these individuals are able to fully understand what would happen to that information.

In practice, this would mean that the organization's request for information can be easily understood by the target audience. This includes making sure that the wording and language used in the request are age-appropriate. For example, a video game designed and marketed to preteens would clearly need to take a different approach to obtaining the consent of players to collect personal information than a video game marketed to adults.

We heard from a number of witnesses during the committee's consideration of the bill, and the majority were supportive of our government's proposed amendments in Bill S-4 to enhance consent.

The Privacy Commissioner of Canada repeatedly expressed his support for the amendment. This is what the Privacy Commissioner told the committee:

Consent is a big part of PIPEDA, and I think it's useful to have this clarification of what actually is consent. We obviously know that it is a huge challenge for organizations to properly advise individuals of the reasons they collect information and they use it, so any tool that enhances, that provides an incentive for organizations to be clearer, and to take into account the context of the individual or consumer I think helps Canadians.

The commissioner further emphasized:

So, when the individual is a child, if your product is addressed to children, you should think about what is reasonable to expect of a child in understanding the consent being sought. Overall, I think, again, the definition of consent in Bill S-4 will assist generally and will assist particularly groups that are more vulnerable, like children.

Privacy information must be clear to the user. The privacy policy should be specific to whatever service the child is using and not be a one-fits-all privacy policy.

The standing committee also heard support for this amendment from a number of other witnesses, including from business. For example, the Marketing Research Intelligence Association, a national self-regulatory body that represents Canada's survey research industry, wrote in a submission to the committee that it fully supports the enhanced consent requirements of the bill.

The association noted in particular that the amendment provides “added clarity for organizations when they seek the valid consent of an individual” when collecting, sharing, and disclosing their personal information. It went on to say:

We believe that specifying the elements of valid consent will go a long way to protecting the most vulnerable Canadians, such as seniors and children.

Our government has already taken significant action when it comes to protecting children online. We have made important progress to shield our children from online intimidation, cyberbullying, and other similar threats and abuse through amendments to the Criminal Code of Canada that were passed under the Protecting Canadians from Online Crime Act.

The amendments put forward under the digital privacy act build on those actions taken to address cyberbullying and represent additional real and tangible measures to protect Canadians and their families from online threats.

PIPEDA has been in force since 2001. Concerns about the protection of children's online privacy were raised with Parliament in 2007 during the first statutory review of this act. There was general consensus among witnesses that children warrant extra privacy protection, given their particular vulnerability to deceptive and privacy-invasive practices. Indeed, at the conclusion of its review of the act, Parliament recommended that the government examine the issue of consent by minors to determine if PIPEDA should be amended.

Our government heard stakeholder concerns and is responding to the recommendations of committee by introducing enhanced protection for the privacy of minors that is now before the House. This is an important amendment, and along with all other measures in this bill, it should be passed quickly.

The digital privacy act takes real and tangible steps to protect society's most vulnerable individuals. I hope hon. members will join me in supporting this bill so that these new protections can come into force quickly.

[Mark Warawa, Conservative, Langley, BC]

Mr. Speaker, why is my hon. colleague across the way opposed to the position of the Privacy Commissioner? The Privacy Commissioner came to committee. The fact is that almost every witness agreed. Some did not agree with Bill S-4, and as we have heard, there were diverse opinions. However, the vast majority supported the changes that Bill S-4 presented, and the Privacy Commissioner was part of those.

Why does the NDP ideology get in the way of recommendations from the committee and the Privacy Commissioner?

[Djaouida Sellah, NDP, Saint-Bruno—Saint-Hubert, QC]

Mr. Speaker, I am pleased to speak about a topic as important as privacy protection.

We need to amend the Personal Information Protection and Electronic Documents Act to bring it in line with the reality of the digital era. The bill seeks to impose new requirements for the collection, use and disclosure of personal information by a company or organization.

What really bothers me about this bill is the provision that would allow organizations to share personal information without a warrant—yes, I did say without a warrant—and without the consent of the individual concerned. That is a major problem.

Even though this bill is called the digital privacy act, it contains a provision that could really interfere with the protection of privacy. I find that deeply contradictory.

Once again, this Conservative government has proven that it spends more time coming up with grandiose titles than working on content. It is also extremely important to point out that between the drafting of this bill and today's debate, the Supreme Court ruled that information such as the data that Internet service providers have on users and clients—IP addresses, email addresses, names, telephone numbers, and so on—is considered personal information and cannot be obtained without a warrant. I am not the one saying that. It was a Supreme Court ruling.

I have some serious concerns about the constitutionality of this provision. The government must comply with the Supreme Court's ruling and remove all the provisions enabling the disclosure of personal information without a warrant.

During the study in committee, a number of witnesses expressed concerns about this very provision. For example, the Privacy Commissioner said the following in a submission:

Allowing such disclosures to prevent potential fraud may open the door to widespread disclosures and routine sharing of personal information among organizations on the grounds that this information might be useful to prevent future fraud.

We want to protect privacy, but it is questionable to allow access to personal information without a warrant, without consent, without any kind of judicial oversight and without transparency. The Conservatives have a poor record when it comes to protecting privacy, and Bill S-4 will not erase the past.

In one year alone, government agencies secretly made at least 1.2 million requests to telecommunications companies for personal information, without a warrant or proper oversight. Why did they ask for this information? We do not know.

The government should have taken advantage of Bill S-4 to close the loopholes in PIPEDA that allow this kind of information transfer without legal oversight, consent or transparency.

There is another provision in the bill that made my jaw drop. This bill would require companies to declare a data loss or breach if and only if it is reasonable to believe that the breach creates a real risk of harm. In other words, it is up to the company itself to determine whether or not it should notify the authorities in the event of data loss. That is crazy.

This measure will actually give companies less incentive to report data breaches by leaving it up to the company whose data were breached to decide whether the breach creates a real risk of significant harm to an individual.

This blatant conflict of interest is what really kills the purpose of this bill because a company will see no benefit to reporting a data breach and every benefit to hiding it. Deciding that a breach is benign will save the company money, damage to its reputation and inconvenience

It will also help the company avoid being put under the microscope by the Office of the Privacy Commissioner of Canada for an audit or investigation. It will create a culture of non-reporting because the commissioner would be nothing more than an observer.

In conclusion, the Conservatives say that their bill is balanced, but we can do much better. We are increasingly aware of the harm that data breaches can cause, so we cannot create a bill that will barely be useful.

We need a bill that will do an excellent job of giving Canadians better protection from data breaches. This bill has not been looked at carefully enough, and we need to fix it. Canadians deserve better.

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, in committee, one of the issues that was discussed at length is elder financial abuse. I would like to ask the member how Bill S-4 would work to combat this serious problem in our society today.

[Anne Minh-Thu Quach, NDP, Beauharnois—Salaberry, QC]

Mr. Speaker, my Conservative colleague spoke about corporate accountability with regard to privacy protection. However, she knows full well that Bill S-4 allows those same businesses to decide for themselves whether or not they will address the complaints people make regarding the use and sharing of their personal information without their knowledge, without consultation and without a warrant.

Many witnesses told the committee that there is a problem with transparency in this bill and that it creates a conflict of interest because the company at fault is the one that decides whether or not the complaint will be addressed. This bill does not provide greater protection for consumers and Canadians. On the contrary, it opens the door to abuse. Many people and experts told the committee that the bill is seriously flawed.

I am wondering how the member opposite can say that this bill is going to protect children when it is flawed. Even the Privacy Commissioner said that the bill does not have the power to really protect Canadians.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Mr. Speaker, as the member of Parliament for Renfrew—Nipissing—Pembroke, it is my pleasure to rise in my place and express strong support for Bill S-4, the digital privacy act. This legislation would make important updates to the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.

I take issues of privacy very seriously, just as do the people in my riding, like teachers, parents, and grandparents. The number one concern that is expressed to me by individuals is their right to privacy and their right to be protected from the misuse of private information. When it comes to the Internet, while it has brought many improvements to the lives of Canadians, the concern always is what happens to the information that is collected from the Internet on individuals and how it may be used.

Under the current law, companies must seek permission from an individual to collect personal information and may only use this information for legitimate business purposes that had been identified prior to collection. Businesses are required to protect this information when it is in their possession, and they cannot share it with anyone, except in the case of very narrow, limited circumstances. The digital privacy act would build on these protection policies and would add new requirements by which companies must abide.

For example, the bill would require companies to inform Canadians if their personal information has been lost or stolen and if they have been put at risk as a result. It would also clarify the rules around obtaining individuals' consent to collect their personal information, clarifications that would ensure children and other vulnerable groups would be protected when they go online.

The recent high-profile criminal court case in Ontario of a hand-picked senior Liberal provincial deputy minister being convicted of charges related to the heinous crime of pedophilia using the Internet demonstrates how dangerous a place the Internet is for children and the continual need to try to stay one step ahead of the bad guys. The fact that an individual could occupy such a senior position for years as deputy minister of education and a senior advisor to the Liberal premier of Ontario, and apparently do so undiscovered until uncovered by an international crime investigation, is shocking. Convicted pedophile Ben Levin was photographed happily campaigning with the leader of the third party in this place undetected, apparently, or otherwise. This demonstrates why we must always keep up our guard, particularly when children are involved. The Internet is a dangerous place for children.

My constituents in Renfrew—Nipissing—Pembroke know that, when children are involved, I will always err on the side of caution. As we have discussed many times before, strong rules are meaningless if they are not backed up with strong compliance tools. I would like to focus my comments in this critical area.

Let me begin by explaining how PIPEDA currently works with respect to compliance. The act is enforced by the privacy commissioner, who has the ability to investigate complaints and the power to launch investigations in the event that he feels an organization is in violation of the law. PIPEDA gives the commissioner broad investigative powers, which allow him to enter premises, compel the production of information and gather evidence. It is a criminal offence to obstruct the commissioner in the process of an investigation. However, for the most part, the commissioner acts as an ombudsman, using a range of dispute resolution tools to address any violations of the act he discovers in the course of an investigation. At the conclusion of an investigation, the commissioner issues a report outlining any violations of the act, a list of recommendations, and an assessment on whether corrective action needs to be taken moving forward.

PIPEDA's compliance regime has, for the most part, been successful in resolving issues brought to the commissioner's attention. Most organizations in Canada are good corporate citizens, and when the commissioner identifies that they are in violation of the law, they move quickly to correct their practices.

Unfortunately, as a lawmaker, I know from experience that there will always be those who try to skirt the rules. That is why Bill S-4 would make some important improvements to PIPEDA's compliance framework. These changes would make sure the commissioner has the necessary tools to ensure organizations respect the law and the privacy rights of Canadian citizens.

First, Bill S-4 would increase the amount of time available to take an organization to court. Currently, an application to the Federal Court has to be made within 45 days after the commissioner issues the report of findings. In their testimony to the standing committee, officials from the Office of the Privacy Commissioner explained why this period needs to be increased. They stated:

As we've experienced in practice, 45 days is a very short time period to resolve some of the highly complex technological issues or broader accountability issues that organizations quite rightly need time to rectify.... We...follow up with them several months, if not a year, afterwards to ensure they did follow through on the recommendations they said they would undertake to do.

To address this issue, Bill S-4 would increase the time in which an organization could be taken to court from 45 days to 1 year. As the Privacy Commissioner pointed out to members of the standing committee, organizations are often given up to a year to implement recommendations. This amendment would enable the commissioner to enforce compliance in court if a company fails to take the necessary action.

The second important change brought forward by Bill S-4 would give the privacy commissioner the authority to enter into binding compliance agreements with organizations. A compliance agreement is a regulatory tool that provides an alternative to taking an organization to court if it was found to be in violation of PIPEDA. Compliance agreements are voluntary but binding agreements. They are agreements between an organization and the commissioner. These agreements benefit both sides. From the organization's perspective, it gets certainty and clarity. From the commissioner's perspective, these agreements increase the accountability of the organization to become compliant with the law. Currently, commitments made by an organization to implement the commissioner's recommendation are non-binding. Compliance agreements, however, would make these commitments binding and enforceable by a court.

The inclusion of compliance agreements in the digital privacy act was supported by a broad range of stakeholders during committee hearings on the bill. The Privacy Commissioner himself stated that there are two main amendments that are very necessary and would be helpful for us to implement and apply. The first amendment he was referring to was about mandatory data breach reporting. The second was about compliance agreements. Similarly, Mr. Tamir Israel, from the Canadian Internet Policy and Public Interest Clinic, stated, “We're particularly pleased to see the inclusion of compliance agreements and an extended appeal period...”.

Finally, Bill S-4 would give the commissioner more power to name and shame, or to publicly disclose information when organizations are not co-operating. Under the current act, the commissioner can only publicly reveal information about the way in which an organization handles personal information. However, the commissioner cannot, for example, disclose that an organization is not co-operating with an audit or is otherwise acting in bad faith. For many organizations, the threat of having their lack of action made public would be an effective tool to hold them accountable and encourage them to comply with the law; and the proposed amendment could be used, for example, against foreign-based companies that are otherwise beyond the reach of Canadian courts.

[Anne Minh-Thu Quach, NDP, Beauharnois—Salaberry, QC]

Mr. Speaker, I would like to ask a question.

Bill S-4 has several flaws with respect to the protection of personal information. For one thing, it would lead to a reduction in the number of complaints and reports of breaches because the complaints made would be managed by the companies themselves. It would be up to the companies that receive the complaints to determine if they are serious enough to be addressed.

John Lawford, the executive director and general counsel of the Public Interest Advocacy Centre, says that this will incentivize not reporting data breaches by leaving it up to the organization to determine whether the breach creates a real risk. That is a real conflict of interest.

I am wondering what the member for Winnipeg North thinks about that. Was the committee told that the fact that this bill reportedly protects privacy when it actually does the opposite is a serious concern?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I thank the member for York West for allowing me the opportunity to share a few thoughts on Bill S-4.

I am used to the member talking very passionately on a wide variety of issues, particularly regarding our seniors. She is a very strong advocate for our pension programs and so forth. It is also very nice to see that she takes the same sort of attitude in wanting to hold the government accountable on an issue that is important to seniors and all Canadians, which is the digital privacy laws, especially since the Internet and the use of it has exploded over the last decade or so.

When we get advancements in technology and witness it first hand, to the degree in which we have, one would expect the government to have an interest in wanting to ensure we stay on top of the issues related to those advancements. However, the government has not done that.

In fact, it is interesting that we are today debating Bill S-4, which is an important issue. If we were to consult our constituents, I think we would hear genuine concern with respect to the type of information that is on the Internet and just how easy it is for a breach of that security, ultimately causing a great deal of harm to individuals. In a macro situation, it could have a severe impact on the economy.

However, we have an important issue in which the Prime Minister has made the determination that he wants to give the bill that final push as we start to wind down after four years of inaction on the file. Now the Prime Minister, with four and a half weeks of sitting days left, wants to rush the bill through the process and pass into law.

As has been pointed out, we had a different situation in the process with Bill S-4. Not only did it come through the Senate, but it was also stopped before second reading and sent to committee for review. From what I understand, that is very rarely done. The reason it is done is to accommodate significant potential changes to the legislation. That tells me the government, the minister responsible for bringing this legislation before us today, understood there were issues related to the legislation that needed to be dealt with before it completed second reading. I am convinced it was the reason the government took the initiative to take the bill out of the normal process and bring it to a committee first.

I suspect the Independent members, the Liberals and the New Democrats believed the government would be open to amendments. That was kind of the impression that was given to us. However, something happened between the decision to bring the bill to committee and have it voted on in committee with respect to the amendments. This is where the Prime Minister's Office interjected.

Through his office, we found that the Prime Minister was not interested in amendments, because all that would do would prolong the amount of debate, possibly, by having it go back to the Senate. He was more interested in being able to make the statement that the Conservatives had made some changes to the law, even though the legislation was flawed.

I want to focus some attention on the fact that we have very important consumer-type legislation related to something about which Canadians in all regions of our country are concerned, and that is the issue of privacy and protecting it.

The amount of purchasing and other items taking place economically on the Internet is increasing every year. The government wants to try to score a political point by saying it is trying to address the issue. In reality, nothing could be further from the truth. If it were really important to the government, I would suggest that Conservatives would likely have brought it in before the last month or two of this session and that the Prime Minister's Office would have allowed for amendments at the committee stage. Why would Conservatives oppose amendments that would improve the legislation? Unless maybe the government did not want the opposition to support the legislation. There is a lot of merit to that. We have seen that in other pieces of legislation: bring in an idea, give it a label, tell Canadians they are concerned about something, but then leave serious flaws in the legislation to try to maybe get the opposition party offside. Who knows?

What I do know is that there are many deficiencies within the legislation, as has been pointed out by the Liberal Party critic or others, at committee. There are serious flaws in the legislation and there were, I believe, 40-plus amendments that were being proposed. Not one of those amendments passed. The government cannot say that it was political parties that were doing the posturing on it. Many of the amendments, including amendments brought forward by the Liberal Party, were taken from experts at committee who made presentations, some credible organizations, government agencies of sorts that came before the committee.

The government made the decision that it was not going to accept any amendments. What surprises me is that if the Prime Minister's Office had been more clear with the minister responsible for the legislation, the bill could have gone through the normal process. The normal process is not that much better. Ever since the Conservative/Reform government received a majority it had a different attitude in terms of how democracy works here inside the chamber.

I have heard about many pieces of legislation, not only this one, where opposition parties or individual members of Parliament would bring forward amendments and the government consistently said “no” and defeated amendments. The government makes a mockery of the system by not allowing members from all sides of the House to move amendments that would improve the legislation.

Subscriber data requests are very important. People are concerned about that. We know that there are victims who need to be warned when there are breaches of security. Personal identity theft is very real. It is happening far too often. The amount of fraud out there continues to grow and is becoming a serious problem.

We need to protect the privacy of Canadians, and this bill would not go anywhere near far enough to address the many concerns that were brought up, whether at committee or by individual members.

The issues are important. The government has dropped the ball. I would suggest that if the Conservatives really wanted to make a difference, they would allow amendments to pass. In essence, that would provide assurance to Canadians that the government truly does care and that it is more than Conservative spin that it is interested in, but there is no sign of that, unfortunately.

[Judy Sgro, Liberal, York West, ON]

Mr. Speaker, let me use the telecommunications companies as an example. There were thousands of times that telecommunications companies were giving access to personal information; that is our information and the information of many others.

My privacy and that of other Canadians needs to be protected. It should not be randomly given out because somebody asks for it. On anything to do with fraud, Canadians should be aware that their credit cards have been compromised. Individuals should be notified of that fact so they can monitor it themselves, not just assume that the credit card company will be on alert to protect their interests. Far too often the consumers are not notified of those kinds of things.

Again, on the issue of committee, my colleague has been here for quite a long time. He is knows how parliamentary committees are supposed to work, and have always worked. When the government came into power, it decided it was not interested in committee work anymore. It did what it had to do to fill in time to go through the basic process.

Bill S-4 came in through the Senate. The bill should have come in through the House, and had the proper work done through a member of Parliament or minister. That is a proper way to deal with legislation. However, bringing it in through the Senate is the back door way of getting things done, and the government has used that approach several times to get through what it wants done.

[Judy Sgro, Liberal, York West, ON]

Mr. Speaker, I am pleased to have an opportunity to speak to Bill S-4. I will be sharing my time with the fabulous member for Winnipeg North.

I am pleased that we are discussing this bill, but again, unfortunately, it is the same Conservative divisive policy of “You are either with us or you are against us.” Members from all sides wanted to see some improvements to Bill S-4, but unfortunately the bill came from the Senate, and any changes were going to disrupt the process of trying to get legislation through very quickly, which is typical, of course, of the government's plan. I can only say that I was disappointed and that I have to stand and say that I have recommended that the Liberal Party vote against Bill S-4.

It is legislation that could have given our digital privacy laws the shot in the arm they so desperately need, and Liberals would have welcomed it if we had had the opportunity to make it better. That was certainly the intention from the Liberal Party's perspective.

As Canadians are increasingly turning to online commerce, education, banking, recreation, and communication platforms, our laws must keep pace in order to protect all of us. Sadly, the government has a wilful ignorance and reckless disregard for reason on such matters, and Bill S-4 proves it again very clearly.

Information oversight and management are not areas that the government has excelled in, so forgive me if my confidence is shaken a bit. I simply cannot accept without proof the government's word that it is actually protecting consumers' interests.

Of course, the way the government looks at personal information protection and privacy has already been subject to a Supreme Court ruling, and once again the court gave the government another failing grade.

This should come as no surprise to anybody who is paying attention to politics in Canada right now. We all remember when the government lost a hard drive that held the social insurance numbers, medical records, birthdates, education levels, and occupations of 5,000 Canadians. In addition, we remember when the interim privacy commissioner revealed that telecommunication companies receive an average of 1.2 million requests from federal enforcement bodies for private customer information every year. That is approximately 3,300 requests every single day for Canadians' personal information.

Perhaps I should also mention the headline that appeared in The Hill Times this week. It warned that Canada's access to information regime is slipping into—guess what—irrelevance. The article went on to reveal that the Centre for Law and Democracy ranks our ATI regime 56th out of 89 countries. I repeat, we are 56th out of 89 countries. We are really way up there, are we not?

The article also said that in September 2014, Canadian Journalists for Free Expression noted that ATI “is severely failing to meet its minimum requirements, let alone adequately serve the population’s needs.”

While I understand that access to information laws are different from digital privacy laws, these examples all point to a government that does not understand information management, yet refuses to seriously consult or listen to the experts on the matter who came before committee. The government stubbornly refused to listen to experts such as Professor Michael Geist and many others who appeared, including lawyers and professors, who said it was a good piece of legislation but that it could be better.

The intent, certainly on the Liberal side, was to try to make it better, but as everyone here knows, Bill S-4 was referred to the committee after first reading, as my colleague mentioned.

This is typically done for procedural reasons, and because it more readily allows for substantive amendments, the referral traditionally indicates the government's willingness to compromise. It was really very unusual for the government to do this, but it was very welcome. We thought that maybe the government had seen the light and that together we could improve this important piece of legislation, so we gladly supported it after first reading. We were preparing to move amendments, work together with the government, and make it a good, strong bill. It was on this implied promise that the Liberal caucus was prepared to support Bill S-4.

Committee members heard from several experts, including the privacy commissioner, IBC, the Canadian Bar Association, Professor Michael Geist and so many more. We took their counsel to heart in those four meetings.

After the hearings concluded, over 42 substantive amendments were presented in good faith, most taken directly from expert testimony. Those 42 amendments came from the three opposition parties in the House.

Let me give an example. I introduced an amendment that was specifically proposed by several witnesses and contributed to the committee study, including the Insurance Bureau of Canada. The amendment dealt with the reporting threshold for privacy breaches. My amendment would have required the reporting of any unlawful breach of personal information security so long as the said breach presented a significant threat of harm to an individual. That same amendment also clarified what a company needed to do to remedy the breach, including a requirement to warn victims that their information was lost. That sounds pretty basic. If my credit card was compromised or my personal information was lost, I would want to know that.

However, the government was unmoved. In just one short meeting, government members defeated every one of those 42 amendments without any explanation or defence. Some of them were out of date already by the time other ones had been defeated. There was no explanation or no big defence. It was simply the silent majority on the other side of the House voted them all down, just like they do all the time at all committees.

Despite warnings of overly broad, cumbersome and nebulous provisions within Bill S-4, the Conservatives took less than three minutes each to consider, discount and defeat everything that the experts had warned us about. As a result, Bill S-4 remains flawed. It has never been fully considered and should not be accepted or passed without a true and unbiased evaluation.

To be clear, there are positive elements to Bill S-4. For example, the legislation grants the Privacy Commissioner the ability to enter into enforceable compliance agreements with companies that have likely breached the act. This provides a regulatory remedy for certain actions and is a positive development. Public Safety Canada said that the bill would help to protect the security and privacy of Canadians by limiting the number of police and security officials who could request subscriber data and applying new requirements for recording, reporting and auditing those requests.

These may be good things, but several independent and credible sources outside of government expressed their concerns with Bill S-4. For example, many warned that metadata could be used to track specific individuals on the Internet and when in the wrong hands, that tracking could represent a serious threat to personal privacy. Bill S-4 utilizes a similar approach, and this is an issue of tremendous concern for those of us on this side of the House.

I want to ensure that law enforcement officials have the information they need to keep us all safe, but a blank cheque approach is inappropriate and promises limited success. We could do better if the government would just listen to the experts and then work with the opposition.

In broad strokes, Bill S-4 represents a shift in the way we deal with digital privacy. Privacy laws have traditionally outlined the rules and procedures needed to protect information and personal data, but in this case the legislation sets up circumstances under which that material could be released.

In a world where crimes involving personal data theft, identity fraud and online stalking are on the rise, protecting data is crucial. Data is not just information; it is a commodity. It is power and it is a back door into our private lives. The Liberals are deeply concerned that the government's commitment to safeguarding personal information and privacy of Canadians is less than absolute with Bill S-4.

Whether driven by Conservative ignorance or intent, Canada is clearly on the cusp of a paradigm shift with respect to privacy laws, and the Liberals are worried about the consequences of Conservative insolence.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, surely the member would recognize that Bill S-4 was put in a unique situation in that it went to committee before it received second reading, thereby creating what turned out to be a false expectation that the government was open to making changes. In reality, all the amendments brought forward were defeated. It was almost like a normal routine of other pieces of legislation that have just gone through the normal process at second reading.

My question to the member is this: why did he feel it was important to isolate this piece of legislation by bringing it to committee before it completed second reading and then sending it to committee stage? Why change the normal procedure, given that the government had no intention of making amendments?

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, I thank my colleague for his presentation today on this important legislation. I would like to ask him, with regard to Bill S-4, if he could elaborate on how our government is working to protect and help vulnerable Canadians, especially children.

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to be here today to speak to Bill S-4, the digital privacy act, which has been referred back to the House by the Standing Committee on Industry, Science and Technology.

As consumers, we are all aware that, in the digital world we live in today, our personal information has become increasingly more accessible. People and organizations exchange huge amounts of information over the course of the day, whether it be through email, Internet browsing, or financial transactions. Digital networks have fast become the most efficient and convenient method of communication for Canadians.

Our government takes the protection of this personal information very seriously. We recognize the importance of having strong privacy protections in place to ensure that organizations are properly safeguarding the personal information of individuals across this country. Bill S-4 would implement changes to the Personal Information Protection and Electronic Documents Act, known as PIPEDA. These modifications would ensure that organizations are taking the appropriate steps to address the handling and protection of information in today's digital era. This bill, entitled the digital privacy act, sets out specific rules that businesses and organizations must follow when personal information they hold is lost, stolen, or accessed, either for malicious purposes or as the result of an accident.

As we have seen in the past year, data breaches continue to present themselves as a major challenge to the privacy and security of information. Breaches can happen in any number of different ways and to any type of organization. Digital information can be stolen through sophisticated cyberattacks or through simple software vulnerabilities that are made public.

Take the Heartbleed incident, for example. According to Symantec, this software glitch that was exposed in 2014 left approximately 0.5 million trusted websites at risk of a serious data breach. Financial information and sensitive customer data can also be left vulnerable in the event of a data breach. Unfortunately, this is a familiar topic for Canadians in today's digital age. Take, for example, last September when Home Depot announced that a data breach by unknown hackers left as many as 56 million debit and credit card customers across North America vulnerable to fraud.

Research shows that the majority of today's data breaches are conducted with malicious intent. The Symantec Internet threat report states that nearly half of all breaches are caused by outside attacks and that these attacks are becoming increasingly sophisticated. Canadians are concerned about this. A recent nationwide survey on Canadian attitudes around data breaches concluded that this issue is creating significant public anxiety. The survey found that 79% of Canadians are worried about being a victim of a data breach. Data breaches are a top-of-mind issue for Canadians. This is not surprising, given the importance of the Internet in the day-to-day lives of Canadians.

Organizations should also be concerned about data breaches, given how expensive these incidents can be to businesses. It is estimated that the cost to combat and recover from data breaches worldwide last year was approximately $364 billion. Business owners need to know that consumer demand for responsiveness to data breaches is increasing. A nationwide survey highlighted that Canadians assume that companies will take immediate action in the event that personal information is lost or mishandled.

That is not all Canadians expect. The same study concluded that over half of all respondents want companies to do the following: provide clear information and instructions on how individuals can protect themselves; and provide them with free credit monitoring for a certain period of time in the event that a breach occurs.

With the digital privacy act, our government is responding to the needs and concerns of Canadians. First, companies would be required to put in place strong security measures to prevent data breaches. Second, companies would be required to respond to a breach if and when it does occur or risk facing a strong penalty. With the changes we have proposed in the digital privacy act, if a company has its computer systems hacked and believes personal information has been stolen, or if that information has been lost inadvertently, the company would need to take a number of steps.

The company would be required to assess the risk resulting from the breach, and if it determines that the incident poses risk of harm, it would need to notify the affected individuals and file a report with the Privacy Commissioner of Canada. On the subject of mandatory breach reporting, the Privacy Commissioner has stated that:

Mandatory breach notification will bring enhanced transparency and accountability to the way private sector organizations manage personal information.

An organization would also have to keep a record of the event, regardless of whether a breach poses an obvious risk of harm. These records would not only allow organizations to demonstrate due diligence in their risk assessment, but they would also require companies to keep track of when their data security safeguards fail. This would help businesses determine whether or not they have a systemic problem that needs to be corrected.

What is more, organizations would be required to provide these records to the privacy commissioner at any time, upon request.

This record-keeping requirement would provide a mechanism for the commissioner to hold organizations accountable for their obligation to report serious data breaches.

Here is what the Privacy Commissioner had to say on record keeping:

I believe that the organization experiencing the breach is in the best position to assess risk and decide whether notification of individuals is warranted.

To provide an appropriate incentive to implement these measures, we believe that there should be serious consequences for intentionally ignoring them or attempting to cover up a data breach. Bill S-4 would make such deliberate acts a serious offence, punishable with fines of up to $100,000 per offence.

These changes are widely supported by stakeholders, as is evidenced by witness testimony during the committee's review of the bill.

The Canadian Internet Policy and Public Interest Clinic said that:

...we're very grateful to see this notification obligation coming into force. It's much delayed and needed.

The Canadian Bankers Association also came out in favour, stating that:

The banking industry supports the requirements in the Digital Privacy Act for organizations to notify individuals about a breach of their personal information where there is a real risk of significant harm.... We also support the Commissioner’s new oversight powers to ensure organizations comply with these new provisions.

Finally, the Canadian Pharmacists Association also expressed its support, saying:

For pharmacists who access a significant amount of sensitive information related to the medication and health of their patients every day, a breach or disclosure of this information has the potential to put the patient at risk.... As a result, CPhA believes that...reporting this breach to the individual concerned and the Privacy Commissioner are reasonable steps to take in order to mitigate any risk that may occur.

It's also reasonable for the organization in question to maintain proper records of these occurrences....

While there was broad-based support for the bill among stakeholders, the committee did hear some concerns about certain elements. One issue on which the committee heard different views is the threshold for reporting data breaches to the commissioner. Some stakeholders felt that the threshold is too high and that more breaches should be reported. Others thought the threshold is too low and that only material breaches should be reported to the commissioner.

The digital privacy act would take a balanced approach, one that avoids over-reporting of harmless incidents and yet allows the commissioner to oversee how organizations are meeting their obligations. The Privacy Commissioner agreed, telling the committee:

I support the risk-based approach that will require organizations to assess the seriousness of each incident and its impact on affected individuals.

Some stakeholders also expressed concern that the obligation to keep records of all data breaches is burdensome. However, the Privacy Commissioner, again, believes that the digital privacy act would get it right, telling the committee:

Requiring organizations to keep a record of breaches and provide a copy to my Office upon request will give my Office an important oversight function with respect to how organizations are complying with the requirement to notify.

Record-keeping can be done in a way that would minimize burden while still allowing businesses to demonstrate that they are conducting the proper risk assessments. The government would need to enact regulations to elaborate on what these records would need to look like and how long companies would need to hold on to them.

As a result, consultations during the regulatory development process would allow for further discussion, with stakeholder input, on this important issue.

Finally, some have questioned the need for fines in this area. The government recognizes that many organizations already notify individuals of data breaches in a responsible manner. However, we know from experience that there will always be those who try to break the rules.

The penalties in the digital privacy act would target those organizations that wilfully and knowingly disregard their obligations under the law or, worse, cover up a breach. These fines would not apply to organizations that make a mistake in good faith.

The Canadian Internet Policy and Public Interest Clinic at the University of Ottawa told the committee that:

We're very grateful to see a penalty regime for instances where the breach notification obligations are knowingly ignored.... The fines currently in PIPEDA are designed as penalties for very overt offences.

Bill S-4 would encourage all organizations to play by the same rules and implement adequate controls and safeguards around the personal information they hold.

Furthermore, I encourage the House to oppose the motion put forward by the Green Party to delete clause 10 of Bill S-4. This would remove the new requirements for organizations to notify individuals who have been put at risk if their personal information is lost or stolen. The amendment ignores the advice of numerous privacy advocates including the Privacy Commissioner of Canada.

On several occasions, the commissioner has recommended that PIPEDA be amended to require mandatory data breach reporting. The digital privacy act would act on this recommendation, and the commissioner has expressed strong support for the approach taken in Bill S-4. The Privacy Commissioner and the majority of witnesses who appeared before the standing committee agreed that Bill S-4 is a significant improvement to PIPEDA and a necessary step in ensuring Canadians' personal information is safeguarded.

I think the Canadian Life and Health Insurance Association said it best in its witness testimony. It said that Bill S-4 takes a balanced approach to the responsibilities placed on business and organizations, but most importantly, it would protect the consumers of those businesses and give individuals the information they need to take corrective action when necessary.

Both business and consumers have been empowered in the digital age, but if Canada is to remain a leading digital nation, Canadians need to have confidence that their online transactions are safe and their privacy is secure.

Bill S-4 would strengthen these rules and increase the protection of Canadians' personal information. In summary, the digital privacy act would balance the privacy needs of Canadians and the ability of businesses to access and use personal information in their day-to-day operations. It would do this in a way that avoids over-reporting of harmless incidents while making it clear to businesses what their legal obligations are.

I hope we can count on the opposition's support and quickly pass the digital privacy act into law.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I agree with my colleague.

With Bill S-4, the government missed out on an opportunity to introduce a system that is in line with the Supreme Court decision in R. v. Spencer.

It is too bad, because this really could have been possible with the amendments brought forward by the opposition parties. Every party here brought forward amendments that would have worked. However, the government decided to reject all of them.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I have a question as a follow-up to the question that my Conservative colleague asked the hon. member.

The R. v. Spencer ruling came down after this bill was studied in the Senate. What is more, Bill S-4 is based on models from British Columbia and Alberta. Some aspects from Quebec are included as well.

However, we saw that a report was tabled by the Legislative Assembly of British Columbia, the region my colleague represents, saying that in light of the ruling in Spencer, it would amend its personal information protection legislation, known as PIPA. If we are basing our legislation on a model that is changing, then I think we have a problem.

Why are we incapable of working together to see what repercussions the Supreme Court ruling might have on our laws, when other legislation, on which we are basing our bills, is in the process of changing?

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, first, I hasten to correct my friend. I have never spoken in this place, or in any serious location, with anything but respect and love for my colleagues.

My second point runs to the testimony provided by Professor Michael Geist that Bill S-4 runs contrary to the spirit of the Spencer decision and that, in fact, by allowing the disclosures to be made with upfront Internet service providers from telecom companies and so on without having the notification to the holder of the information, in his words:

The provision opening the door to massive expansion of warrantless, non-notified, voluntary disclosures should be removed....

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I want to start by expressing my sincere thanks to my colleague from Terrebonne—Blainville, who just delivered a very important speech. She worked very hard on her own bill on this topic, and I think her bill should have been passed. In my opinion, her bill was far superior to Bill S-4.

I share the sentiments of the hon. member for Winnipeg North. He, like the member for Terrebonne—Blainville, said that all the opposition parties thought that in light of the work that went into the current bill and all the others, such as Bill C-12, the government might make the effort to take a collaborative approach with the other parties. Unfortunately, that was not the case.

Here we are, looking at Bill S-4, a bill that comes to us after, as we have heard from other members, a convoluted process, a bill that died on the order paper, a superior private member's bill that failed when the Conservatives did not support it. It is an effort to bring up to date the Personal Information Protection and Electronic Documents Act, otherwise known as PIPEDA.

This is, of course, a very significant area of citizen and consumer concern. PIPEDA was passed in 2000, and a lot has changed in the world of digital information, privacy concerns, and information held by Internet providers, banks, and a great number of organizations to which Canadians trust their private information online.

Bill S-4 should have been an attempt, and may in fact have been an attempt that failed, to adequately balance the privacy rights of Canadians and the important facilitation of commerce in Canada. That would certainly be the expectation.

The larger context around which the bill comes to us is one in which we have had some rather spectacular accidental breaches of the privacy of Canadians through the release, through various errors, human errors, of health information, consumer information, and banking information because of breaches in the system.

One would have thought, especially in the specific context of the last year, that in drafting the bill, the government would have been very cognizant of the decision of the Supreme Court of Canada in June 2014 in the Spencer decision. That was a decision written by Mr. Justice Tom Cromwell, one of my former friends and professors from my time at Dalhousie Law School, a brilliant legal mind and someone who has, within the Supreme Court of Canada, written a number of critical and important decisions. The Spencer decision is one of them.

The Supreme Court of Canada, in Spencer, came down very clearly on the side of the privacy rights of Canadians. Mr. Justice Tom Cromwell wrote in his decision:

...the Internet has exponentially increased both the quality and quantity of information that is stored about Internet users. Browsing logs, for example, may provide detailed information....

He went on to note that users would never really know when their information was forming some sort of pattern that resulted in a review, and users, consumers, would not know when their information might be becoming accessed. However, in entering into agreements with ISP providers, the Supreme Court of Canada, through Mr. Justice Cromwell, noted that there is a “reasonable expectation of privacy in subscriber information”.

There is no denying that Bill S-4 would do some things that are fairly universally approved of by those who are leading critics in this area. The Privacy Commissioner for the Government of Canada, and of course, the Privacy Commissioner is an officer of Parliament, saw a number of significant improvements.

The Privacy Commissioner started his review by turning his attention to the purpose of PIPEDA in the beginning, back in the year 2000, noting:

The purpose...is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

Given the fast-changing world of digital communications, with the Internet, the cloud, and all the various ways in which we now store information online, fortunately Parliament saw fit in the year 2000 to include a five-year mandatory review of PIPEDA so that we could keep up with the ways in which technology moves so rapidly.

Generally speaking, some of what is being done here has met with universal support. The risk-based approach that would allow organizations to assess each incident on a case-by-case basis was supported by the Privacy Commissioner, at least. The Privacy Commissioner would have an opportunity to enter into compliance agreements, but while the Privacy Commissioner found this acceptable, numerous other commentators did not. They did not feel it went far enough or actually protect privacy information adequately.

The things that met universal approval I will list briefly. The improvements in Bill S-4 include the additional qualification and clarification of what is meant by the standard of consent, the extension of a deadline to take cases to the Federal Court, and of course, the expansion of the powers of the Privacy Commissioner to publicly disclose information related to findings. These were things the Privacy Commissioner liked.

Leading critics include, and my friend from Terrebonne—Blainville has already pointed to one of the leading critics in this area, Professor Michael Geist, advisers, and a very exceptional group of lawyers who now work a lot on information privacy law at the Public Interest Advocacy Centre, where, in the 1980s, I was also associate general counsel. However, in those days, believe me, we did not have open files on Internet data and privacy, because we were mostly dealing with trying to advocate in areas of technology that now seem very outdated. In any case, the Public Interest Advocacy Centre has stayed on top of the technology.

We had from the Canadian Bar Association, the Public Interest Advocacy Centre, Professor Michael Geist, and of course, members of opposition parties a rich group of substantive and helpful amendments that would have led to universal support for this bill at that moment. Unfortunately, those amendments were all rejected.

I want to look at three aspects in the time I have left this afternoon: compliance agreements, the expansion of voluntary disclosure, and transparency reporting.

Compliance agreements are a source of concern. The way in which they are drafted in Bill S-4 would have been acceptable had they been strengthened and had penalties or had an order-making power been available to the Privacy Commissioner, but they have none of those things. The Canadian Bar Association brief made this point about it:

Our principal concern is that while entering into such an agreement with the Privacy Commissioner stays any court enforcement by the Commissioner, it does not have any effect on any affected individual’s right to go to court against the organization for the same matter under investigation. This omission means that there is a much lower incentive for organizations to enter into such agreements. Also, it is not consistent with the regime in other similar schemes.

Despite recommendations to improve this, no improvements were made.

Second, the expansion of voluntary disclosure is probably for me the most significant failure of Bill S-4 and is quite inexplicable in that it runs directly counter to the Spencer decision I referenced earlier. This needed to have much more rigour to ensure that there was no warrantless access. This is the key issue. The task force should have come down harder for privacy rights.

Last, in transparency reporting, there should have been reforms to require organizations to publicly report on the number of disclosures they make without knowledge or consent and without a judicial warrant.

This information should have been disclosed on a regular basis for transparency, and organizations should have been required to notify affected individuals within a reasonable time of any accidental disclosure.

With that, I regretfully conclude that Bill S-4 does not meet the standard this Parliament should expect of an update to PIPEDA.

[Laurin Liu, NDP, Rivière-des-Mille-Îles, QC]

Mr. Speaker, I would like to thank my colleague from Terrebonne—Blainville for her work on this issue, which she knows a lot about.

We know that the Conservative government introduced Bill S-4 as a way to protect consumers. It is trying to sell the bill as a bill for consumers. However, consumer advocacy groups, lawyers, professors and even the Privacy Commissioner have indicated that there are problems with the bill, such as the provision on voluntary disclosure.

Can my colleague comment on the lack of balance in this bill?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I appreciate the comments made by the member, but I do want to express some concerns as to the manner in which Bill S-4 was brought into the House.

The member made reference at the beginning of her comments about how she was optimistic at the beginning. I think there was a shared sense of optimism that we had the bill go on a different routine. As opposed to completion of second reading and then go to committee, we wanted the committee to provide some feedback so that we could look at making some more significant changes.

There were a number of presentations made. A number of amendments were brought forward. At the end of the day, the government showed no sympathy in terms of accepting what witnesses were telling the committee, nor amendments that were being brought forward, whether from the Liberal Party or others. Given the importance of information, in particular online banking and things of this nature, and the issue of privacy, we have really lost an opportunity to make some positive contributions through changes to the legislation.

I would ask the member to reinforce what she started off her speech with: the importance of the government recognizing a sense of co-operation that was there at the beginning and not responding well, which has ultimately led to a great deal of opposition to the bill we are now being asked to vote on.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, unfortunately we will oppose Bill S-4 for the reasons I will provide in my speech.

What I am especially disappointed about is that we all voted in good faith for this bill to be studied in committee before second reading. We told ourselves that we could perhaps work together to improve the bill and eliminate the most problematic parts or ensure that it would truly protect Canadians in the digital age. Unfortunately, that did not happen, even though we know that there are more and more risks associated with protecting personal information online.

For more than four years, we have been in Parliament with the same government that rejects all our motions and refuses to work with us in committee. This time, I do not know why, but I had hoped that we could work together.

Usually, a bill is sent to committee before second reading because there are problems with the bill and we want to make changes. Perhaps we want to change something or make changes to PIPEDA that go beyond the immediate scope of the bill. We had hoped to work together. Unfortunately, that did not happen.

That is why I moved three motions today to remove the most problematic sections from this bill. These motions will be voted on together.

We heard over and over that these two sections—clauses 6 and 7—are extremely problematic. These clauses will make it easier to share people's personal information without their consent and without them even knowing that their personal information is being shared. The government is trying to broaden the scope of situations in which information can be shared without consent. That is extremely problematic.

Obviously, there are sometimes extreme circumstances that require personal information to be shared. Such situations exist. Everyone knows that. We take issue with the fact that there is no transparency. There is no mechanism in place to ensure that this information is shared only in exceptional and urgent circumstances. What is more, the threshold of reasonable suspicion is very low.

As a result, we voted against these clauses when the bill was examined in committee. Unfortunately, the Conservatives decided to go ahead with them anyway.

We even proposed amendments to improve these clauses by restricting the kind of situations in which information sharing can happen and creating a system that encourages transparency. There has to be an accountability or oversight mechanism to ensure that this information sharing only happens under exceptional circumstances. That is really not the case.

As I said, we proposed amendments to improve the bill because everyone in the House of Commons knows that protection of personal information is a big issue right now, one that is really important to our constituents.

I even give computer security courses to seniors in my community because they want to understand how to use new technology and they want to have a certain level of confidence when it comes to protecting their information and their identity.

Everyone agrees that this is an important issue and that we have to update PIPEDA to ensure that it can better address the threats present in the digital age in the 21st century.

Unfortunately, the Conservatives' approach was to put something on the table and refuse to accept any amendments or listen to what the witnesses had to say. They just forged ahead.

All of the parties proposed amendments, except for the Conservatives, of course, and all of the amendments were rejected. The NDP even proposed 18 separate amendments that were all rejected.

Most of all, I deplore the fact that from the beginning of the committee's examination of this bill before second reading, the Conservatives said they did not want to change anything. Why should we bother voting to send something to committee before second reading if, from the beginning, the Conservatives have already decided that they will not change anything? It makes no sense. It also demonstrates bad faith. We are supposed to examine bills with an open mind and a desire to improve them, correct their shortcomings and work together. That is what it means to live in a democracy.

The Conservatives even insulted some of the witnesses during the study in committee, telling them that they could choose to either vote for the bill in its current form or accept that there would be no changes to the Personal Information Protection and Electronic Documents Act before the next election. I understand we are having an election soon, but the Conservatives had plenty of opportunities to modernize the Personal Information Protection and Electronic Documents Act. There was Bill C-12, which simply disappeared because of prorogation. The bill that I introduced in the House contained very similar provisions to the ones found in Bill S-4, but the Conservatives voted against my bill.

These changes could have already been in the legislation. Unfortunately, the government suddenly says the timeframe is too tight and the only thing we can do is pass the bill as is despite all its problems and flaws. The government simply wants to pass the bill as is. I think the Conservatives are being disingenuous about this. To tell all the witnesses that the choice is between this bill and nothing is really insulting to them after they took the time to travel here to share their opinions and present their proposed changes.

Since the government rejected all the amendments and we did not manage to improve the bill, the NDP will have to vote against it even though we recognize that some provisions are a step forward, although they do not go as far as they should. Nonetheless, I cannot vote in favour of a bill that will create more opportunities for personal information to be shared without consent, without authorization, without the individual concerned being informed, and without a proper oversight mechanism. That is what this bill would do.

Clauses six and seven, which my motions would eliminate, will weaken the protection of privacy by allowing the sharing of personal information without the consent and authorization of the individual concerned. I already stated that the threshold was very low. I proposed raising the threshold so that the organization asks questions before sharing this information. The Conservatives refused. The Privacy Commissioner even raised concerns about this provision. He said that it could open the door to abuses, and that is what we found. This government made 1.2 million requests to Internet service providers to obtain personal information as a result of flaws in the Personal Information Protection and Electronic Documents Act. There have been actual abuses. As members of Parliament, we cannot consciously open the door to further abuses. However, that is exactly what clauses six and seven of this bill do.

I will now read what the Privacy Commissioner said at the February 17, 2015, meeting of the Standing Committee on Industry, Science and Technology:

Under the proposed amendments, potentially any organization will be able to collect or disclose personal information for a broad range of purposes without any mechanism to identify which organizations are collecting or disclosing the information and why.

This is very problematic because according to its title, this bill is supposed to create the digital privacy act. I am sorry, but there is a problem when parts of the bill contradict its objective. You do not have to be a genius to understand that.

I would like to share a quote from Michael Geist, who also testified at the Standing Committee on Industry, Science and Technology on March 10, 2015:

...the broad provision that we have here opening the door to massive expansion of non-notified voluntary disclosure without any of the kinds of limitations that we typically find even the courts asking for should be removed....With respect, it is both not well studied and ought to be fixed. Canadians deserve better.

He also took the opportunity to disagree with the process that the Conservatives put in place and the idea that we should pass this bill without amendment because we are out of time.

The warning mechanism for a data security breach proposed in the current bill is another problem. Many parliamentarians understand the need for such a mechanism. This was brought up in the committee on which I sit, the Standing Committee on Access to Information, Privacy and Ethics, while we were studying this bill.

As the Privacy Commissioner has said many times, we must require that organizations notify individuals when their data are compromised. In a number of cases, as with Target and Home Depot, the data of thousands of people have been compromised or lost completely. Since the people in question are not always informed, they are not in a position to protect the compromised data. That is a huge problem.

Bill S-4 fixes this problem but does not really go about it in the right way. The proposed model is much too subjective because it allows the organizations themselves to determine whether a data breach creates a real risk of significant harm to an individual. The organizations therefore have to police themselves. They also decide for themselves whether to inform, or not, the Privacy Commissioner and the individual affected of any data breaches that occur.

The model that I am proposing is more objective. I proposed it before when we were examining this bill in committee and when we were examining my private member's bill, Bill C-475, which could have been passed already had the Conservatives not voted against it. This model would give the Privacy Commissioner the power to determine whether a security breach is serious enough to inform the individual. Thus, it would not be up to the organizations to do it.

What is more, PIPEDA covers all organizations, from convenience stores to large digital technology corporations. Some organizations, such as convenience stores that have only a couple of employees, are unable to determine how serious a data breach is. It is therefore important to allow them to turn to an expert, namely the Privacy Commissioner.

I would like to read a quote from John Lawford, the executive director and general counsel for the Public Interest Advocacy Centre, who testified before the Standing Committee on Industry, Science and Technology on February 19, 2015. He said:

Unfortunately, Bill S-4, as written, will very likely result in fewer reported breaches than even now and operate in an opposite manner. Namely, it will create a culture of fear, recrimination, and non-reporting. Bill S-4, incentivizes not reporting data breaches by leaving the determination of whether a breach creates a real risk of significant harm to an individual totally in the hands of the organization that suffers the breach. This obvious conflict of interest is fatal to the purpose of the bill as there is no advantage to a company to report and every advantage to hide a data breach.

As he said, the proposed mechanism is much too subjective. It is unfortunate that the Conservatives refused to implement a more objective system.

This bill does not give the Privacy Commissioner the power to issue orders. The former privacy commissioner, Jennifer Stoddart, asked for that repeatedly. Provincial privacy commissioners also wanted it because they have that power.

All too often, organizations do not act on recommendations made following an investigation by the Privacy Commissioner. Big international companies do not think they need to comply because it is just Canada, but Canada's laws must be respected. When our laws and the Privacy Commissioner's recommendations are constantly ignored, we need to fix that problem.

We could give the Privacy Commissioner the power to issue orders, but there is nothing about that in the bill. Instead, it calls for compliance agreements, which do not go far enough and do not really motivate organizations to act on the recommendations because they are not orders. We wanted to fix this problem, but once again our proposal was rejected.

I would have liked them to adopt the model I proposed in Bill C-475. I suggested following the usual investigation procedures, after which the commissioner would issue orders and set a deadline for compliance. The parties would act in good faith. For example, if problems were not resolved within a year, the Federal Court would impose a fine.

This system would give organizations that comply with the law and the recommendations a chance, with no repercussions whatsoever. However, if we do not find a solution and do not encourage organizations to respect privacy, there will continue to be abuse, and the law and the Privacy Commissioner's recommendations will continue to be ignored.

Bill S-4 is a step in the right direction, but it does not go far enough. That is what I said throughout the entire study. As a matter of fact, some witnesses also said it was important to have a system that truly encourages privacy protection.

What is more, given that we studied this bill in committee before second reading, we had the opportunity to correct other problems with the Personal Information Protection and Electronic Documents Act, because we knew there were some flaws. Under what circumstances is it acceptable for the government to submit at least 1.2 million requests a year for personal information to Internet service providers? This is a serious problem, but nothing is being done about it.

I thought we could sit down as parliamentarians and come up with ways to put oversight and transparency mechanisms in place and even get rid of these flaws and abuses. This was a missed opportunity.

Recently, the Supreme Court established in Spencer what was reasonable and not with regard to privacy protection. Unfortunately, that ruling was not taken into consideration during the study in committee. The Personal Information Protection and Electronic Documents Act was not amended in order to make it consistent with the Supreme Court ruling. That needs to be done. The government needs to show some vision and correct these flaws to provide better protection of Canadians' privacy because that is what Canadians deserve.

Speaker's Ruling

[The Speaker, Conservative, Andrew Scheer]

There are five motions in amendment sitting on the notice paper for the report stage of Bill S-4. Motions Nos. 1 to 5 will be grouped for debate and voted upon according to the voting pattern available at the table.

The House proceeded to the consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as reported (with amendment) from the committee.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I agree with the hon. member so far as his first statement is concerned, that this has been a good week for Canadians.

It has been, because today the House of Commons voted on a ways and means motion and introduced a budget bill that would reduce the small business tax rate from 9% to 7%, although the NDP voted against that this morning, and it brought in a family tax cut to bring fairness to families, except the NDP and the Liberals voted against that.

We also introduced, of course, expanded flexibility for seniors on their RRIFs and increased room for all Canadians on tax-free savings accounts. Unfortunately, the Liberals and NDP voted against it, but that does not matter, because we delivered, and Canadians will get to enjoy the benefits of that because of the vote we had today in this House.

It has indeed been a good week for all Canadians, certainly those who care about and want lower taxes.

After this statement, we will debate Bill C-52, the Safe and Accountable Rail Act, at report stage and third reading. This bill strengthens Canada’s rail safety system, and I understand that all parties are interested in seeing this bill move forward quickly.

As I announced in the House yesterday, tomorrow shall be the third allotted day. Monday will be the fourth allotted day. Additionally, I am designating Monday as the day, pursuant to Standing Order 66(2), when we will conclude the debate on the eighth report of the Standing Committee on Finance.

On Tuesday morning, we will continue the debate on Bill C-52.

After question period today, we will consider Bill S-4, the digital privacy act, at report stage and second reading. This legislation would provide new protections for Canadians when they surf the web and shop online. These changes to protect Canadians' personal information are key elements of Digital Canada 150, our government's plan for Canada's digital future.

Starting on Wednesday, and for the remainder of next week, we will debate Bill C-59, economic action plan 2015 act, No. 1, which was introduced earlier today, as I already referenced.

This critical economic legislation would reduce taxes, including many of those I already spoke about, and deliver benefits to every Canadian family through the family tax cut; our enhancements to the universal child care benefit; encouraging savings with enhanced tax-free savings accounts; lowering the tax rates for small businesses; introducing the home accessibility tax credit, a very important improvement for seniors to help them stay in their homes for longer; and expanding compassionate leave provisions; and the list goes on and on.

As the hon. member said, it has been a very good week for Canadians, even though he opposes all of those measures.

Regrettably, the Liberal leader, earlier this week, announced that he would raise taxes for middle-class Canadians by replacing that very same family tax cut with a family tax hike, and despite this Liberal tax, the Liberal leader is discovering that budgets do not balance themselves. He has a $2 billion hole in his plan. Canada cannot afford that kind of reckless, high-tax, deficit-building approach.

In voting against our tax cuts for families set out in the ways and means motion the House adopted—

[Krista Campbell]

Your question is at the heart of much of what government really needs to consider. If you think of what it's been into recently in digital privacy with respect to Bill S-4, there are some really important fundamental things government needs to think about with respect to the privacy of the individual and the frameworks in place to ensure both government and other interfaces, whether it's businesses, or charities, or third-party organizations, respect an individual's privacy. There needs to be clear rules that an individual, a consumer, or a citizen can understand with respect to they've gone online, they've purchased something, they've consented to this but not to this, and therefore, they have assurances and know their identity has been protected with these known sites.

With respect to things like cyber and ensuring that we have a secure set of infrastructure, that individuals have confidence that they're able to use the Internet for the right purposes and not be hacked, the government continuously works with international partners that look at the governance of things like the Internet and ensures that policies and practices are put in place that businesses can then commit to. We have disruptive technologies in certain areas like quantum, which could be incredibly disruptive once they are commercialized, that this committee will undoubtedly be running across in terms of a whole game changer for cyber and protection.

There are roles for government in thinking about supporting things like data literacy and consumer literacy when they are online. Financial services are one of the areas where Canadians are the most concerned. We have very strong provisions at some of the financial institutions within Canada for things like mobile payments and mobile wallets. So government must be continuously encouraging work in those areas so Canadians have security in terms of their identity, they have recourse, and they know that government is pushing the boundaries for these policies. But in many instances, as you indicated, it is government reacting to the changing environment and trying to stay up to speed with what's going on. It's very difficult and challenging to figure out where that next disruption is coming from.

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I thank the hon. opposition House leader for his question.

This afternoon we will continue debating economic action plan 2015, our Conservative government's balanced budget, low-tax plan for jobs, growth and security.

He was referring to it and its impact on future generations, and that is where this budget is perhaps at its best, because it delivers long-term prosperity.

With the tax-free savings account, it will provide benefit for generations to come. It helps families save for their children's university education. We have put an additional element in the budget to allow greater flexibility with student loans with calculation of income.

In fact, it is future generations who stand to benefit the most. The most important element from which they benefit, something they would never see under an NDP government, is a balanced budget. That means they will not be paying the freight for generations that came before them for high-spending debt plans that we see from the opposition parties. That is the most important long-term benefit for future generations, so we are very proud of the budget in this regard. Of course, we have been hearing from my colleagues this week that it is a prudent and principled plan that will see Canadians more prosperous, more secure, and everyone confident in Canada's place in the world for some time to come.

While we are focused on creating jobs and putting money back in the pockets of hard-working Canadians, the opposition parties have both confirmed that they want to see higher spending and higher taxes on middle-class families, high taxes on middle-class seniors, high taxes on middle-class consumers. In fact, any tax they can raise, they will probably take a shot at it when they get the chance.

The budget debate will continue on Tuesday and Wednesday of next week.

While I am talking about the budget, I cannot help but note that, when pressed Tuesday night for some detailed insight into the Liberals' economic vision for Canada—something we have been waiting for since the hon. member for Papineau became the Liberal leader two years ago—that member told reporters that he would keep it secret from Canadians for yet more weeks—or months—to come.

I am going to give him an opportunity next week to be courageous and share an actual proposal with Canadians—something beyond the view that budgets balance themselves. Therefore, Monday shall be the second allotted day.

Meanwhile, we will start the report stage debate on Bill C-51, the Anti-terrorism Act, 2015, tomorrow. Through this legislation, the government is taking additional action, in line with measures taken by our allies, to ensure our law enforcement and national security agencies can counter those who advocate terrorism, prevent terrorist travel and the efforts of those who seek to use Canada as a recruiting ground, and disrupt planned attacks on Canadian soil.

Next Thursday, after we have concluded the budget debate, we will consider report stage and second reading of Bill S-4, the digital privacy act. This legislation aims to protect better and empower consumers, clarify and streamline rules for business, and enable effective investigations by law enforcement and security agencies.

In anticipation that Bill C-46, the pipeline safety act, will be reported back from committee soon, we will start report stage, and hopefully third reading, after question period that day.

We will round out next week with the debate on Bill C-50, the citizen voting act, at second reading, on Friday.

Industry, Science and Technology

[David Sweet, Conservative, Ancaster—Dundas—Flamborough—Westdale, ON]

Mr. Speaker, I have the honour to present, in both official languages, the sixth report of the Standing Committee on Industry, Science and Technology in relation to Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act. The committee has studied the bill and has decided to report the bill back to the House without amendment.

[Christopher Padfield]

To add, I think that's part of the rationale in Bill S-4 and the additional powers that were given to the commissioner with that longer period of time to go to court. Under PIPEDA previously, it would have been 45 days, but Bill S-4 extends that to a year. It gives the commissioner more of a timeframe to go in.

It also expanded the commissioner's name-and-shame powers, if you like. The commissioner can more publicly report on a broad range of activities that companies are undertaking, which I think was one of the issues in the Bell case. The commissioner made his findings public, which he's not required to do, but he thought it was in the public interest to make them public.

I think Bill S-4 provides additional authorities and powers that still fall within that ombudsman model that has been so effective, and doesn't move the commissioner into a regulator role and more of a conflictual role with the private sector.

[Bruce Hyer, Green, Thunder Bay—Superior North, ON]

This amendment reverts back to the proposed language for notifying the Privacy Commissioner about security breaches, which is found in the previous PIPEDA reform bills C-12 and C-29, but it is stronger and clearer. Why? It creates a mandatory security breach disclosure requirement at the federal level, and that is long overdue. Geist at the Senate said that Bill S-4 establishes the same standard of “a real risk of significant harm” for both notifying the commissioner and the individuals, but also said this is very puzzling. It means that there is no notification for systemic security problems within an organization. This is very likely to result in significant under-reporting of breaches. Our amendment creates incentives for organizations to better protect that information and allows Canadians to take action to avoid risks including identity theft.

[John Clare]

Let me just point out to the committee how what is proposed is different from having the organization do an assessment of two thresholds in making that determination. As Madam Borg pointed out, the NDP amendment does create a two-step process, so an organization would first determine whether or not a breach posed a possible risk of harm and that would go to the Privacy Commissioner. Then the Privacy Commissioner would look at the data breach and determine whether or not notification to individuals was warranted.

The standard applied by the Privacy Commissioner would likely result in an appreciable risk of harm. The organization is accountable for telling the Privacy Commissioner, which creates an accountability on the part of the Privacy Commissioner to do a risk assessment and determine whether or not individuals will be notified. Bill S-4 places the accountability for both of those things on the organization itself.

Madam Borg's second point was that the amendment gives the Privacy Commissioner the power to order a company to notify individuals, whereas under PIPEDA currently and under Bill S-4, the Privacy Commissioner doesn't have the ability to make those orders.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

In testimony on Bill S-4 we heard a lot of different opinions on the implementation of a notice mechanism for data breaches. This is a contentious point. In fact I examined this at length when drafting my bill. I am referring here to Bill C-475 which was unfortunately defeated because of the Conservative Party.

Through this amendment, I want to propose a more objective threshold. Indeed, I would like the Privacy Commissioner of Canada to be responsible for assessing the prejudice the person whose data has been lost, breached, and so on could suffer.

This legislation does not only apply to large businesses, but also to small ones. However, small enterprises do not necessarily have the necessary means to determine if the data breach is serious. These businesses could turn to the Privacy Commissioner of Canada. He knows these issues and is in a position to determine whether the data breach justifies notifying the person.

Moreover, this amendment would allow the Privacy Commissioner of Canada to order organizations to inform the persons concerned. This would also force organizations to notify people and would give the commissioner a little more power. Indeed, he could ensure that the privacy of individuals dealing with the organizations is respected.

I think this threshold is more objective, that it would afford better privacy protection, and that it would reduce the burden on small businesses.

Thank you.

[John Clare]

The amendment has two parts. Many witnesses came before this committee and talked about the threshold for when organizations would be required to report a privacy breach to the Privacy Commissioner and the thresholds for when they would be required to notify individuals. That's the substance of the first amendment.

The proposed amendment would create two thresholds. For a report to the Privacy Commissioner, the breach would need to be a material breach. The criterion for a material breach is essentially that there's an aspect of risk, but I would argue it's designed to be a less objective test. You do look at the sensitivity of the information, but primarily you look at how many individuals were affected. Then the organizations do an internal review, and they ask whether this represents a systemic problem and whether it is evidence that they have a bigger problem here that they should tell the Privacy Commissioner about.

The other threshold is, as proposed in Bill S-4, the notification to individuals. This is unchanged. It would be a breach that is determined to pose a real risk of significant harm. This is a risk-based threshold. We look at the circumstances, the sensitivity and the probability that the information will be misused and the potential harm that it could cause, and those are the breaches we would tell individuals about.

It establishes these two thresholds, so what the Privacy Commissioner would be told about wouldn't necessarily be the same data breaches that individuals would be notified about.

From my own perspective what I found interesting about the testimony that the committee heard is that, on the one hand, business organizations like this because they don't want to have to tell the Privacy Commissioner about the one-off breach, the one that was really serious but only affected four or five people. They wonder why they need to tip off the Privacy Commissioner that this has happened. They'd rather only tell the Privacy Commissioner about the big problems, and deal with these with their clients directly.

Privacy advocates, on the other hand, didn't see these two thresholds as necessarily different. They saw them as nested in some way, so that the material breach was actually a lower threshold and that the Privacy Commissioner would hear about all of those breaches that affect one-offs—two or three people. But then for the ones that go to the individual, it's a higher threshold of that higher risk. They saw it that way.

From a policy perspective and as administrators of the law, the fact that you saw those two different views suggests that the provisions are not necessarily as effective and clear as they could be, if you have different stakeholder groups interpreting them in very different ways.

The committee may be aware that those two thresholds, the material threshold and the real risk threshold, were in previous versions of government bills to amend PIPEDA. But when Bill S-4 was drafted, this issue was examined and it was determined that because of those competing views, it was more simple, more effective for there to be a single threshold. An organization would look at a data breach and they'd say, “Is there a risk of harm in this circumstance? If there is, I have to tell the Privacy Commissioner and I have to inform the individual.”

That way the Privacy Commissioner knows about every single data breach that goes out to individuals. But to create accountability and to make sure that organizations are conducting these risk assessments in good faith, Bill S-4 creates a new requirement that wasn't in previous bills, and that's to maintain the records.

The process is very straightforward. I have a data breach. I determine if there is a risk. If there is, the notification goes out. If the determination is that there isn't a risk, that this may be evidence of a systemic problem or something like that, I have to maintain a record. The policy rationale behind that is that as soon as you require an organization to record this information and maintain it, they're going to pay more attention to it and this is how they're going to determine whether or not they have a systemic problem.

Bill S-4 gives the Privacy Commissioner the power to demand those records at any point. There's no threshold. The commissioner doesn't have to have any suspicion that something's going on. He can ask to see a company's records.

This gets to the second part of the amendment, which deals with that record-keeping requirement.

The committee heard witnesses saying that they were concerned about this requirement. What information were they going to have to maintain in the record? How long were they going to have to keep it for? They were nervous about the burden that it would create. The only thing I would point out to the committee is that all of those specific requirements will be set out in regulation, and there will be an opportunity to consult broadly with it.

The intention of the record-keeping requirement is to maintain only that information that's necessary to meet those two objectives I talked about: making sure the company pays attention to it, and providing a way for the commissioner to hold the company accountable for that risk assessment.

To the extent that the requirement to document a data breach may create a conflict in law that may be contrary to some other law, we're not aware of any federal statute that would prohibit a company from documenting that they have suffered a data breach. As for the specific requirements, if there was concern that there may be a conflict in law if the regulations, say, you have to keep it for five years and there is some other requirement that says you have to destroy these things after two years, all of that would be addressed during the regulatory process and it wouldn't be necessary to have that chapeau in the act saying unless prohibited by law.

[John Clare]

Thank you, Mr. Chair.

To be clear, the language proposed in Bill S-4 is that the disclosure would need to be necessary to establish, manage, or terminate the employment relationship and the amendment would add “and reasonable”.

We've talked about the reasonableness threshold already and what that entails. The fact that subsection 5(3) of the act already provides this overall requirement that any collection, use, and disclosure be reasonable in the circumstances, the use of the term necessary was intended to establish a higher threshold than reasonable.

In other words, the collection, use, or disclosure of that specific personal information is required for the purpose. So it would only be information that is required to establish, manage, or terminate an employment relationship. It wouldn't include any other information in the context of someone's employment.

[John Clare]

Mr. Chair, I would just point out the difference between these amendments and the NDP's amendments. The NDP amendments propose to change the threshold. These types of disclosures would still be permissible in certain circumstances, but it changes the threshold for when the disclosures would be permitted. This amendment would remove the exception entirely, so it would eliminate any exception to consent for either fraud prevention, detection, or suppression activities, or private investigations.

It's worth pointing out that the amendment in Bill S-4 that provides these exceptions.... They are not new exceptions. They change the way that these disclosures happen. Currently there are provisions in PIPEDA that allow for private investigations. We refer to it as the “investigative bodies framework”. Bill S-4 repeals the investigative bodies framework and replaces it with these exceptions. This amendment takes out the exceptions from Bill S-4, but it doesn't return back to the status quo.

[Bruce Hyer, Green, Thunder Bay—Superior North, ON]

Mr. Chair, these amendments deal with deleting the lines regarding new warrantless disclosure provisions that go from company to company. As they're drafted in Bill S-4, companies will be able to share the general public's information without our knowledge or consent. Privacy experts are most concerned about this aspect of Bill S-4.

There has been a surge of recent cases of what some people call “copyright trolling”; in other words, companies sending extensive legal letters to customers threatening huge fines for downloading movies that people have never heard of.

As it stands, Bill S-4 would allow involved service providers to offer this information to anyone without the consent of the individual. Therefore, we feel that warrantless, non-notified voluntary disclosures should be removed from the bill.

[John Clare]

Thank you, Mr. Chair.

This is a recurring theme through about four of these amendments of replacing the standard as proposed in Bill S-4, which is that the investigation or the fraud prevention activities would need to be reasonable for those purposes, with the standard of the organization having to have reasonable grounds to believe that something had happened warranting an investigation, or that fraud had occurred warranting the fraud detection, suppression, or prevention activities.

The second part deals with the last part of the test as proposed in Bill S-4, which says it would be reasonable to expect that disclosure with the knowledge and consent of the individual would compromise those activities.

This group of amendments replaces “reasonable for the purpose” with “reasonable grounds to believe”. The two thresholds are different as I've mentioned in the last response. The “reasonable for the purpose” is an objective standard. Looking at a situation, a court or the Privacy Commissioner would look at the conduct of the organization in the circumstances and look at whether their actions in disclosing the information are reasonable. Did they exercise good judgement? Were they fair? They would look at factors like the sensitivity of the information being disclosed and the seriousness of the conduct that was being investigated, in the case of investigations, or the seriousness of the fraud that was being looked for.

By changing to “reasonable grounds to believe”, it increases the threshold to the point where the organization would have to have compelling and credible evidence that something had occurred that warranted an investigation, or have compelling and credible evidence that fraud had occurred. It's a higher threshold. The reason why Bill S-4 proposes a lower threshold is that the purpose of these investigations in many circumstances, and the fraud protection prevention and suppression activity, is precisely to obtain clear and compelling evidence to meet that threshold of “reasonable grounds to believe”. The organization then can move from “I have a suspicion” or “I have an allegation of wrongdoing” to conduct some sort of internal investigation, determine that there is clear and compelling evidence that wrongdoing had occurred, and then move it to the next level. In the case of a criminal matter, that's referring it to law enforcement or in the case of an agreement among professional associations, such as lawyers or doctors, moving it into disciplinary action against the member of the organization.

[John Clare]

Thank you, Mr. Chair.

This issue was raised during the first statutory review of PIPEDA that was carried out in 2006-07. The recommendation of the committee at the time was that the government consult with stakeholders and the Privacy Commissioner to examine the issue of the use of personal information when it's contained in a witness statement for the purpose of processing an insurance claim.

There was a concern raised at the time and discussed during the consultations. If I witness an accident, say that I saw an individual recklessly driving through an intersection, and provide that witness statement to the police, there was concern in the insurance industry that the individual who drove recklessly through the intersection could refuse and not provide consent for the use of his or her personal information—the fact that they were at that place at that time—for the purpose of processing the insurance claim.

Based on the consultation, there was a pretty wide agreement among the stakeholders, including privacy advocates at the time, that you didn't want to create a situation whereby individuals can protect themselves from responsibility in an accident, essentially, by invoking their personal privacy and saying that the witness statement can't be used because it contains their personal information. The purpose of the amendment in Bill S-4 is to provide a very limited exception so that insurance companies can get access to witness statements that contain personal information, only for the purpose of processing the insurance claim.

[Bruce Hyer, Green, Thunder Bay—Superior North, ON]

Thank you, Mr. Chair.

As you know, these three paragraphs in amendment deal with sharing information related to insurance claims. Our amendment is based on recommendations from the Privacy Commissioner.

Bill S-4 contains three separate provisions allowing an organization to collect, use, or disclose witness statements without consent at the request of the insurance industry. We have not been presented with any information or evidence demonstrating that the absence of these provisions has created any problem for the industry. We introduce these amendments in the hope of limiting the potential for fishing expeditions, to put it bluntly.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

Following the testimony we have heard, and several revelations in the media, parliamentarians and society realized that, unfortunately, there are far too many cases where the exceptions in the PIPEDA are used in far too broad and vague a way. There is no transparency regarding the exceptions that permit the sharing of personal information without consent and without a warrant.

I think that today we have to broaden our study and not only examine Bill S-4 and PIPEDA. That is what we must do when we study a bill at second reading.

That said, I move that section 7 of PIPEDA be repealed, so as to correct the flaws in this law that allow for the sharing of personal information without consent and without warrants.

[The Chair, Conservative, David Sweet]

Good morning, colleagues.

Good morning, everyone.

Welcome to the 40th meeting of the Standing Committee on Industry, Science and Technology. Today we're considering Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act.

We are pleased to have three experts here, officials from the Department of Industry. Lawrence Hanson is the assistant deputy minister for science and innovation. Christopher Padfield is the director general of the digital policy branch, and John Clare is the director of the privacy and data protection policy directorate.

Thank you very much for joining us, gentlemen, and for being here for questions.

Colleagues, we have, as you can see piled in front of you, quite a number of proposed amendments to the bill. I was saying to my fine officials beside me that a chair never does this enough to get really slick at it, so we'll proceed, with your patience, through the bill. The officials have kindly batched the amendments together.

Unless I have some specific instruction from you, colleagues, on how to proceed, I'll just begin with the first clauses that have no amendments, then we'll move to the clauses that have amendments, and proceed in that way.

Is that fine for everyone?

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Thank you, Mr. Chair.

I'm in the same position I was last week, when many of the questions I would have had were already answered.

I was struck by listening to the testimony today. You go through so many of the different areas that we've talked about, and we've heard witnesses say one thing to one extent and then different witnesses at a different time have said something completely on the other side of an issue and suggested that we move in a different direction.

I remember one witness in a previous meeting talking about the importance of getting this right, and I noticed that phrasing was in the Credit Union's opening statement saying that in this case they thought Bill S-4 does get it right, or gets a lot of things right.

On consent, for example, we've heard arguments that we should go in one direction or another. We've heard that with breaches: people saying it goes too far; people saying it doesn't go far enough. On information sharing now we're hearing the same thing.

Ms. Gratton, in your comments it was interesting, because I think your opening statement captured that balance, and the question of balance that we're trying to strike. It sounds like you think the legislation needs to go forward—you said that in questioning—but at the same time you have some questions. They're not necessarily declarative statements that this is what's going to happen down the road, but you asked whether we can find ways to avoid “over-disclosing”.

As this legislation hopefully passes and moves forward, what you are going to be watching for over the next few years in terms of the execution of this? We've heard, for example, on that issue, that in Alberta and B.C. there haven't been issues with that. Someone said that it's different circumstances with the federal legislation.

[Mark Warawa, Conservative, Langley, BC]

Thank you, Chair.

Thank you to the witnesses.

I'd first like to provide a brief history of how we are where we are, and then ask for general comment from each of you on whether you support Bill S-4 going ahead or not going ahead. Then I will have some specific questions.

PIPEDA was passed in 2000. It came into force in 2001 to 2004, I believe. We can make changes to legislation in Parliament by legislation or by regulation. If it is by regulation, you regulate changes to existing legislation. It is also very common, and often required, that legislation be reviewed every five years. PIPEDA was reviewed in 2006-07, and some of you were involved in making recommendations as witnesses or by presenting submissions. The responsibility of the government is to listen to those and try to create a balance. Any legislative change is not going to get support from everyone for everything, because there are opposing ideas. But in general, I think, our government has reached that balance, and most of the witnesses from whom we have heard want Bill S-4 to go ahead.

We are about eight weeks away from this Parliament ending, and you may be the last group of witnesses that we hear from before we start dealing with the bill and working as a committee to see if we have any amendments. If there are amendments to this bill, given that there are only eight weeks left, it would be just about impossible, in my opinion, for Bill S-4 to move ahead, because it would then have to go back to the Senate.

I think I have heard general support for the bill going ahead.

Mr. Bundus, I think you said you don't want to stop it with these amendments; you want it to move forward.

I think, sir, you noted that changes could be made by regulation, which they can, if there are additional changes that need to be made.

Perhaps you could make a quick comment: do you support Bill S-4 moving ahead as it is now, or do you not support it moving ahead?

Maybe I could start with the Credit Union Central of Canada.

[Randy Bundus]

I'd like to highlight four of them. It's not that we would say, “Stop the bill and make these happen”, but in our mind, they would make for a better bill.

For example, in paragraph 7(1)(b), which is collect without consent in certain circumstances, we would also like to have a reference to collecting for the purpose of detecting, preventing, and suppressing fraud. We have the right to disclose for that purpose. Just to balance it out, having the right to collect would sort of be the other bookend to that.

We would also propose a small change to proposed paragraph 7(3)(d.2), and that's in the written submission we gave. It's to make sure we really have the ability to conduct those fraud analytics in a way that was recommended by the Ontario fraud task force.

A third change is with respect to proposed paragraph 7(3)(c.1). This is the provision that says you don't have to give access when someone makes an access request in certain circumstances. There's a reference in proposed paragraph 7(3)(c.1) to no access. We want to make sure there should be no access if the information is collected as part of the work product. We've added that work product aspect to the bill if we're able to collect information as part of a work product.

For example, insurers have claims files, adjusters have claims files, and we collect personal information in those claims files. In those claims files is also the reserve amount that has been set for that particular claim. It would be quite inappropriate in our mind to have to release the amount of that reserve amount for a particular claim via a PIPEDA request at the request of the person who is at the other side of the transaction. We would like to have that fixed if we could.

The fourth item is with respect to paragraph 9(3)(a). An amendment has been made already under Bill S-4. We suggest in addition to having solicitor-client privilege, that litigation privilege also be a basis for that.

I would not stop the bill from being passed, but just have those changes. It would be a better world.

[Judy Sgro, Liberal, York West, ON]

Thank you very much, Mr. Chair.

To all of our witnesses, thank you for taking the time to come out and to help us deal with an important piece of legislation.

I think we could talk to the Insurance Bureau an awful lot more. What other changes would you like to see in Bill S-4 that would ultimately help you in your quest to have the tools you need to deal with the kind of insurance fraud that's going on—related to Bill S-4? You mention in your brief about having other issues other than the ones that you mentioned today.

[John Carmichael, Conservative, Don Valley West, ON]

I am anxious to know how you track these fraudsters who come into the system. In your opening remarks, you talked about organized crime, different body shop organizations, and other types of groups that come into this. There has to be a way of tracking this.

Does Bill S-4 give you the tools to do what you need to do in order to start to address some of these issues?

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Mr. Chair.

Welcome to our witnesses. Thank you for appearing today.

I'd like to begin with Mr. Pigeon and Mr. Martin on the credit union side.

You spoke about elder abuse and fraud. You suggested, in your opening comments, that we're doing some things right with Bill S-4. I wonder if you could expand on it. You say in here that the measure could be refined, however, by making it possible to disclose suspected abuse to a member of the individual's family, and that research has shown that often, in the case of elder abuse, the next of kin is the abuser. You also talk about CUSOURCE as a training program, or you've taken some of your solutions and are applying them to day-to-day operations.

I wonder if you could talk about Bill S-4 and how this is making it more feasible to track elder abuse. What are you doing through CUSOURCE to make it work?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Ms. Gratton, do you think that the compliance agreements as proposed in Bill S-4 are sufficient to really encourage businesses to respect people's personal information?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Mr. Bundus or Mr. Dubin, I would put the same question to you.

In your testimony at the Senate on Bill S-4, you said that you preferred the breach notification mechanism model that is used in Alberta. Do you still feel that way? If so, can you explain why?

[Dr. Éloïse Gratton]

Yes, those suit me. I know that certain reservations were expressed with regard to the record. All of the records need to be kept. I'm also aware of the position of the Canadian Bar Association, which also has certain reservations as to the records that would have to be kept.

Bill S-4 suggests that the commissioner and individuals be notified in this type of situation where there is a high risk of prejudice. I like that. In practice, when I divulge breaches, I advise individuals, but I also often advise the commissioners. These things are often done together. It does not bother me that the same criteria do not apply to disclosure.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

I also have a question concerning the breach notification mechanism proposed in Bill S-4. In your opinion, could this model adequately protect people's personal information?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

I thank the witnesses for their presentation.

My first question is for Ms. Gratton.

In your presentation, you spoke of the need to change the mode of consent. Do you have some concrete proposals on what we could do? This could be done through an amendment to Bill S-4, or an amendment to the Personal Information Protection and Electronic Documents Act, PIPEDA, so as to change the method of consent to bring it more into line with what you have described.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you, Mr. Chairman.

First of all, to the Insurance Bureau of Canada, as a designated investigative body, IBC's investigative services division can already share information to investigate contraventions of the law. Why are the proposed changes to this framework in Bill S-4 necessary?

[Randy Bundus, Senior Vice President, Legal and General Counsel, Insurance Bureau of Canada]

I'm glad as well, Mr. Chair. Thank you.

My name is Randy Bundus, and I am senior vice-president, legal and general counsel, with lnsurance Bureau of Canada. I am joined by my colleagues Maddy Murariu, with IBC government relations, and Rick Dubin, with IBC's investigative services. We are pleased to be here today.

IBC is the national industry association representing over 90% of private home, car, and business insurers in Canada. My remarks will focus on how Bill S-4 will affect my industry's ability to continue to combat insurance crime, which includes fraud and auto theft.

Insurance crime is big business in Canada. A recent Ontario government task force estimated that in that province auto insurance fraud alone costs up to $1.6 billion yearly. Insurance crime costs everyone in higher premiums and increased costs to our legal and medical systems.

Our industry works hard to suppress and prevent insurance crime through early detection, and also works hard to protect our customers' privacy. Insurers know that they must safeguard customers' personal information or risk losing business.

There are different types of insurance crime. It can be opportunistic. For example, a driver hits a guardrail and then invites a friend, a “jump-in”, to falsely state that he was also in the vehicle and suffered an injury for which he then claims compensation. Opportunistic claims are handled by insurers, but PIPEDA does not allow one insurer to verify facts by reaching out directly to another insurer that might also have been victimized by the suspected fraudulent incident.

Insurance crime can also be premeditated and organized. Large crime rings stage collisions that involve fraudulent injury claimants and others such as auto body shops and medical rehabilitation clinics. A crime ring can generate several million dollars in fraudulent claims.

IBC's investigative services, or ISD, was the first designated investigative body under PIPEDA, and it plays a critical role in the investigation of organized insurance crime. ISD is uniquely positioned to investigate organized insurance crime that involves multiple insurers, multiple claims, and multiple claimants. An example of this is the case of a police officer in Peel Region who was convicted in February on 42 counts, including 21 counts of fraud. This officer falsely reported nine collisions and, as a result, 14 insurers paid out almost $1 million in false claims to 69 participants.

ISD begins an investigation as a result of being made aware of an anomaly in an insurance claim. Information triggering an investigation may come from an insurer, a victim, law enforcement, or a tip from an informant. ISD then acts as a case file manager, coordinating investigations and identifying linkages between parties that are then submitted to regulators and other enforcement agencies. Individual insurance companies are not well positioned to handle organized crime on this scale.

This brings me to Bill S-4. We support the proposal in Bill S-4 to repeal the sections in PIPEDA that create investigative bodies and instead allow for an organization to disclose information to another organization in limited circumstances. These circumstances, as set out in Bill S-4, are to investigate a breach of an agreement or contravention of a law of Canada, and to detect, prevent, or suppress fraud.

My industry's experience under PIPEDA in investigating and detecting insurance crime has been of mixed success. While IBC's investigative services have been successful in combatting large, organized insurance crime, that has not always been the case for insurers in handling the opportunistic fraud. This is because many of the insurers are not able to disclose to each other information about suspected insurance crimes.

The proposed changes in Bill S-4 would help investigations into opportunistic or one-off insurance crimes involving only two claimants with two insurers, such as the jump-in example I gave earlier. Bill S-4 would allow insurers to disclose, in those very limited circumstances, when it is reasonable to do so, information to another insurer without the involvement of an investigative body.

An insurer could also disclose that information, in the same very restricted circumstances, to an organization such as ISD in the investigation of insurance fraud. In our view, this new process would be efficient and effective in detecting, preventing, and suppressing fraud, while still being respectful of privacy rights. Under Bill S-4, ISD could continue to function as a case file manager for organized insurance crime.

In our written comments to this committee, we address a number of other important issues in Bill S-4, including some minor wording changes to ensure consistency among the provisions allowing for responsible fraud investigations. We would be pleased to discuss these matters with this committee or with Industry Canada officials.

Thank you for your attention. I'd be happy to take any questions.

[Marc-André Pigeon, Director, Financial Sector Policy, Credit Union Central of Canada]

Thank you, Mr. Chair.

I also thank the committee for the opportunity to share with you our thoughts on Bill S-4.

Before addressing our views on this bill, I would like to begin by making a few preliminary remarks regarding the role of my organization, Credit Union Central of Canada, and more generally, the credit union system in Canada.

Canadian Central is the national trade association for its owners, the provincial credit union centrals. Through them, we provide services to about 315 affiliated credit unions across the country.

As you may know, credit unions represent an important part of the Canadian economy. We have about 1,700 credit union branches that serve 5.3 million Canadians. We have $170 billion in assets and 27,000 employees.

Credit unions in Canada come in all shapes and sizes. It's important to understand that some of our smallest credit unions have less than $10 million in assets, one full-time employee, and one part-time employee. Our biggest credit unions have $20 billion in assets and literally thousands of employees. So there's a lot of disparity or gap there. Regardless of size, however, as member-owned and controlled institutions we believe we have an inherent responsibility to be open and accessible while, at the same time, demonstrating the greatest respect for the protection of our members' privacy.

The Credit Union Code for the Protection of Personal lnformation, adopted by credit unions in advance of the 2004 compliance deadline, really speaks to the system's long-standing commitment to member privacy. In fact, well before it was required or fashionable, this code reflected the credit union system's commitment to protect member privacy by proactively implementing consent requirements for the use of personal information. This commitment to member privacy is enhanced through employee training programs, strong internal policies and procedures, and member awareness programs.

In general, we think Bill S-4 does a lot of things right. We are especially pleased with the provisions that would make it easier for credit unions to share personal information with the next of kin or authorized representatives when the credit union has reasonable grounds to suspect that the individual may be a victim of financial abuse. However, we think this measure could be refined somewhat by making it possible to disclose suspected abuse to a member of the individual's family. Research has shown that often, in the case of elder abuse especially, the next of kin are the abuser. We think a little stretch would help with that situation.

We are especially encouraged by attention to this important public policy issue because the credit union system has taken a bit of a lead on this issue of elder abuse. We've designed a course for front-line credit union employees on financial elder abuse detection and prevention and recently made an announcement to that effect with Minister Wong in Winnipeg. We also like Bill S-4 because it does a lot to reduce some of the regulatory burden that results from the current framework.

To give you an example, we are supportive of the proposal that would make it less difficult for institutions to share information when they're in merger discussions. As you may know, the credit union system is rapidly consolidating, so this is a welcome development. Similarly, we support the proposed amendments that permit the sharing of information between organizations for the purposes of fraud prevention. This too will reduce the administrative burden associated with some of the activities of Canadian Central, my organization's Credit Union Office for Crime Prevention and Investigation.

We note, however, that as drafted, the information sharing between financial institutions appears to be limited to the detection and suppression of fraud. We would recommend that financial institutions be allowed to share information related to criminal activity to cover the broader range of activities that we want to capture: bank robberies, ATM breaches, and that kind of thing. We also have some concerns about provisions that may increase regulatory burden.

Specifically, the legislation proposes requirements that would compel financial institutions to keep records of all data breaches. As you know, the reporting requirements say that breaches must be divulged when they pose a real risk of significant harm to individuals. We're not clear why it is necessary to impose record-keeping requirements that are not aligned with this reporting test. The usefulness in recording incidents that do not meet the significant harm reporting threshold is not readily apparent to us. We would recommend aligning the record-keeping requirement with the proposed reporting requirements. We also question the proposed potential penalty of $100,000 for non-compliance with this new record-keeping requirement. While this may not be a material amount to some of our larger competitors, you can imagine the impact of a fine like this on a small credit union with $10 million in assets and whose profits are well under $1 million. This could really harm the credit union. We'd recommend that the fines be geared to the size of the institution.

To help put these concerns in context, just to give you a sense of why these large and small institution issues matter to us, we did a study back in 2013 on regulatory burden. We found that small credit unions, those with fewer than 23 employees, devote fully one-fifth of their staff time to regulatory administration. It's a huge burden for our smaller institutions. Our bigger institutions devote only 4%, and keep in mind that our biggest institutions are many times smaller than the biggest banks out there.

The unintended consequence of a lot of the regulations that get imposed on the credit union system is that they inadvertently create a competitive advantage for larger institutions, and that's a concern for us. In fact, we raised that concern with the finance committee here at the House of Commons, and they agreed. They said that “the government should examine means by which credit unions and caisse populaires could be on a level playing field with Canada’s large financial institutions”. We think there are a couple of areas in this proposed legislation that could be tweaked to address that concern.

To conclude, we want to thank the committee for this opportunity to share our thoughts on Bill S-4. We applaud the government for some important and positive changes, especially around information sharing to prevent financial abuse of seniors and to reduce administrative burden.

That said, we would recommend adjusting the bill to allow financial institutions to share information related to criminal activity in order to cover crimes such as bank robberies, ATM compromises, and so on. We are also recommending that the bill be modified to make it possible to disclose suspected abuse to a member of the individual's family, not just next of kin. Finally, we would just ask that the government continue to be sensitive to the needs of smaller financial institutions by, for example, aligning record-keeping with record-reporting requirements and making fines for non-compliance proportional to the size of the institution.

We want to thank the committee again for our opportunity to share these perspectives, and we look forward to your questions. Thank you.

[Frank Zinatelli, Vice-President and General Counsel, Canadian Life and Health Insurance Association Inc.]

We will both be making a presentation, Mr. Chair.

My name is Frank Zinatelli. I'm vice-president and general counsel with the Canadian Life and Health Insurance Association. I'm accompanied today by my colleague Anny Duval, who is counsel with the CLHIA.

The CLHIA represents life and health insurance companies, accounting for 99% of the life and health insurance in force across Canada. The Canadian life and health insurance industry provides products that include individual life and group life, disability insurance, supplementary health insurance, individual and group annuities, including RRSPs, RRIFs, TFSAs, and pensions.

The industry protects almost 28 million Canadians and about 45 million people internationally. The industry makes benefit payments to Canadians of $76 billion a year, has $647 billion invested in Canada's economy, and provides employment to over 150,000 Canadians.

We welcome this opportunity to appear before the committee as it reviews Bill S-4, which makes important amendments to the Personal Information Protection and Electronic Documents Act.

For over 100 years, Canada's life and health insurers have been handling the personal information of Canadians. Protecting personal information has been long recognized by the industry as an absolutely necessary condition for maintaining access to such information. Accordingly over the years, life and health insurers have taken a leadership role in developing standards and practices for the proper stewardship of personal information.

For example, in 1980 we developed right to privacy guidelines that represented the first privacy code to be adopted by any industry group in Canada. Since then, the life and health insurance industry has participated actively in the development of personal information protection rules across Canada, starting with Quebec's private sector privacy legislation in 1994, the development of PIPEDA, Alberta's and B.C.'s personal information protections acts in the early 2000s, and health information legislation in various provinces.

The industry's overarching theme is to achieve harmonization in the treatment of personal information across Canada as much as possible. The operations of life and health insurers are national in scope, and many common day-to-day transactions may involve interprovincial collection use and disclosure of personal information. Thus, the coordination or harmonization of the provisions of PIPEDA with privacy legislation at the provincial level is very important to avoid unproductive duplication and confusion for consumers, organizations, and regulators alike.

With harmonization in mind, let me turn now to Bill S-4, the digital privacy act. The industry is generally supportive of the bill, as it contains some needed updates that move PIPEDA to be more consistent with other private sector privacy legislation in the country.

For example, B.C. and Alberta deal with the use of information without consent of the individual more effectively than is now the case in PIPEDA. In this regard, the industry strongly supports those amendments to section 7 of PIPEDA, particularly proposed paragraph 7(3)(d.2), which would help industry efforts to detect, deter, and minimize fraud. The impact of fraudulent and deceptive conduct on insurance and other financial services can be extremely costly and damaging.

The industry efforts to control the incidence of fraud are not in conflict with our protection of personal information, but we note that there's a gap in the current legislation that restricts the ability of organizations to disclose information without consent of the individual for the purpose of conducting an investigation into a breach of an agreement or of a law of Canada.

While it is industry practice to obtain consent, there exist clear instances where this cannot be done—for example, where the suspected perpetrator is a third party that is not directly involved with the insurance contract, such as a service provider to a member of a group benefit plan.

In some instances, obtaining consent makes no sense. For example, this latter situation is contemplated in a note to principle 3 of the CSA model code for the protection of personal information, which forms part of PIPEDA:

When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information.

For these reasons, we support Bill S-4's amendments to section 7 of PIPEDA, which more clearly set out when personal information can be collected, used, and disclosed during an investigation.

This will allow all parties to more clearly understand the range of acceptable circumstances when there is an exception to consent and will have the additional advantage of being harmonized with the approach used in both the Alberta and B.C. PIPA.

[Dr. Éloïse Gratton, Partner, Borden Ladner Gervais LLP]

Thank you very much for providing me with the opportunity to speak to you today.

My name is Éloïse Gratton. I am a partner at Borden Ladner Gervais. I also teach a privacy law course at the University of Montreal law faculty.

I've been practising in the field of privacy law for over 15 years and I represent a range of clients, mostly private sector businesses from various industries. I appear today in a personal capacity, representing only my own views and not the views of my firm or its clients.

My time is limited, so I'm going to first mention two provisions in Bill S-4 that have my support, and then two that raise concerns.

I offer my support to two important provisions in the bill: mandatory breach notification and business transaction exception.

I have concerns with two provisions in Bill S-4, the first one being the clarification on valid consent. I know that many have appeared before me to discuss Bill S-4 and they have expressed their approval of the proposed amendment to clarify the requirements for valid consent.

Yes, in theory, not many people would logically object to having more stringent provisions governing valid consent; still, I have a few concerns with this proposal.

PIPEDA currently requires that consent be reasonably understandable by the individual. The questions that should be asked are: do we have a concern with this consent requirement, and if so, will the proposed amendment address such concerns?

If the proposed amendment is accepted, the message sent to organizations is that the way they used to get consent may no longer be valid and that perhaps they should be taking additional steps.

PIPEDA is based on a “notice and choice” model that may prove to be a real challenge in 2015. In my recent book Understanding Personal Information, I have a chapter dealing with the challenges with this notice and choice approach. I was raising that in our day and age, it is debatable whether this model still makes sense and is a realistic one. Very busy individuals with limited time are expected to review, understand, and agree to various different—sometimes online—terms of use agreements, and keep up with new technologies and business models constantly evolving.

We have also already begun witnessing how consent forms are now requiring a few additional clicks to ensure that express consent is obtained in compliance with the new Canadian anti-spam law, since under this law certain information has to be brought to the attention of the user separate and apart from the standard terms of use agreement. I am mostly concerned that this type of amendment will be translated by organizations including additional verbiage in their already very long privacy statements and by requiring more clicks from users already overloaded with information.

I also have some reservations about the two new proposed paragraphs 7(3)(d.1) and (d.2), which would allow an organization to disclose personal information to another organization without consent in certain circumstances, although I understand in some situations the necessity for this proposal.

A few files have landed on my desk over the last few years in which this type of provision would have come in handy. One example worth noting was the case of Stevens v. SNF Maritime Metal. It's a case that ended up in the Federal Court in 2010. This was the case of SNF, a company purchasing scrap metal from another company. That company's employee, Mr. Stevens, opened a personal account with SNF and started selling a high volume of scrap metal to them. SNF disclosed the fact to his employer, who was already suspecting that someone was stealing scrap metal from them. The company realized that its employee was indeed stealing from them. They fired him and the employee then sued SNF for breach of his privacy.

Although SNF was probably right to disclose this information to its client, it was nonetheless a technical breach of PIPEDA, since they had disclosed personal information about Stevens, the fraudulent employee, to its employee and their business partner without his prior consent.

The bottom line is that I agree that we need to have a provision authorizing the disclosure of personal information without consent to address these types of situations. Still, given the way the proposed provision is drafted, I am concerned that the amendments could lead to excessive disclosures, used for broad purposes justified under the investigation of a breach of an agreement provision, or the purposes of detecting fraud provision. These disclosures would further be invisible to both the individuals concerned and to the Office of the Privacy Commissioner.

If we could find a way to minimize the risk of over-disclosing, while including a provision under which companies disclosing in such a situation would have to be transparent about these disclosures, I would offer my support to this type of amendment.

Thank you. I welcome your questions.

[The Chair, Conservative, David Sweet]

Good morning, ladies and gentlemen. Bonjour à tous.

Welcome to the 39th Meeting of the Standing Committee on Industry, Science and Technology.

Again we have witnesses here in regard to Bill S-4.

From Borden Ladner Gervais, we have Éloïse Gratton. Welcome.

From the Canadian Life and Health Insurance Association, we have Frank Zinatelli, vice-president and general counsel; and Anny Duval.

From the Credit Union Central of Canada, we have Marc-André Pigeon, director of financial sector policy; and Rob Martin, senior policy adviser.

From the Insurance Bureau of Canada, there is Randy J. Bundus, senior vice-president, legal and general counsel; Madalina Murariu, acting manager, federal affairs; and Richard Dubin, vice-president, investigative services.

We will begin with the opening statements in order.

I think you've been advised that you have five to six minutes for your opening statements.

Madame Gratton, please begin.

[Annick Papillon, NDP, Québec, QC]

I would like to get back to bill S-4. As we know, this bill would give the Privacy Commissioner new powers to conclude compliance agreements with organizations. However, given that there will likely be insufficient resources at the Office of the Commissioner, do you not think that he may be overwhelmed by the task, and that every breach that occurs will be submitted to him?

M. Levin, could you answer that question, please?

[Prof. Avner Levin]

I think the clause is good because it provides greater clarity. If we are going to stay with the regime of consent, you want something that is clearer rather than more vaguely worded. My broader concern about where Bill S-4 is right now in 2015 is that we have seen that all of these ideas of consent are not actually effective. We need to see much stronger protections in other areas, in terms of regulating use and disclosure.

But I think the clearer language is a very welcome step, from my perspective.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

I would also like to raise the issue of consent, which is I think of concern to all of us. The fact that there are 10-page forms that people cannot read is indeed very worrisome. Bill S-4 at least sets the stage for limiting the circumstances in which consent could be considered valid. This is in clause 5 of the bill. Several witnesses made different comments on that clause.

Mr. Levin, Mr. Brown and Ms. Romanko, since you spoke of the most vulnerable populations, I would like to ask you whether in your opinion this clause is appropriate as it stands, or whether it should be amended. If so, what would you propose?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

I thank the witnesses very much for being here today.

My first question is for Mr. Levin.

I had the opportunity of hearing your testimony at the Standing Committee on Access to Information, Privacy and Ethics. You said that businesses had to be motivated to protect people's personal information.

In my opinion, Bill S-4 is an improvement, but it does not go far enough to encourage companies like Google and Facebook to properly protect individuals' personal information. You mentioned briefly that you were in favour of compliance agreements, but you added that they should confer more powers.

Could you provide some further explanations on that?

[Judy Sgro, Liberal, York West, ON]

Could we possibly do it with amendments to Bill S-4?

[Judy Sgro, Liberal, York West, ON]

Thank you very much, Mr. Chair.

Welcome, and thank you for sharing some of your time and your insights into this issue.

Professor Levin, the penalties we're talking about go from $10,000 and up for people who don't report.

There seems to be such an easy way to have breaches of people's privacy today. Constantly, everywhere you go, you're being asked to tick a box that says “I agree”. A piece of software that I looked at yesterday had seven pages. Now I'm not going to read those seven pages—I'm just being blunt—and I don't think anybody else is who's not some high-tech person who has a specific reason that they're looking at that. However, in order to have access to that particular program, I scrolled through the seven pages and clicked “I agree”. I tend to think that's what a lot of people do.

Could you comment on that? I mean the object with Bill S-4 is to make privacy legislation better and strengthen people's confidence in it. I think that's what we all want to do.

[Mark Warawa, Conservative, Langley, BC]

We have nine weeks of work here, including the constituency weeks, and a lot of work to do before this Parliament wraps up.

Is it important that we pass Bill S-4 within this Parliament, or do you think we should be waiting? Will we leave people vulnerable if we don't pass S-4?

[Catherine Romanko]

Thank you.

Yes, I would be happy to do that. Of course, my comments are very narrowly restricted to the ability of financial institutions to report.

The Public Guardian and Trustee of British Columbia was working closely with the Canadian Bankers Association back when these proposed amendments were first suggested. We were very much in support then of allowing an amendment that would enable financial institutions to report proactively, not just when there was an actual contravention of the law.

It is in that proactive measure that we think vulnerable persons are better protected. Then the responsibility for investigating falls to the provincial bodies, the public guardians and trustees, to do what they already are able to do under the law.

The missing piece was the proactive reporting. Bill S-4, in the provision in proposed paragraph 7(3)(d.3), I believe will accomplish that. I believe that is a positive measure.

[Mark Warawa, Conservative, Langley, BC]

Thank you, Chair.

Thank you, witnesses, for being here.

I want to focus my questioning on how the digital industry has so dramatically changed since PIPEDA first became law in 2000. I believe that things have changed dramatically since it came into effect. It actually came into force from 2001 to 2004, over three years. Then, as is normal, there was a judicial review, a parliamentary review, and that started in 2006-07. I think some of you have been involved with that and have provided submissions or have testified.

Bill S-4 contains I think important updates that relate to what we saw when it was established in 2000. In regard to what's being proposed now in Bill S-4, the world has changed. Technology has changed dramatically. That includes the number of people who are using digital technologies for emails, banking, and so on.

We've heard from you. We've created Bill S-4. It provides important updates to current private sector privacy laws that will help protect consumers with regard to their personal information, whether it's been stolen or lost.

There is currently no legal requirement for a business to inform consumers when there has been a data security breach. A business could be hacked and decide right now not to inform customers, but the changes in Bill S-4 will compel businesses to report when hacked and will impose fines of up to $100,000 per individual if the business fails to notify the customer.

It also provides some very important focus on protecting the vulnerable, both the youth and our seniors.

Ms. Romanko, you touched on that, as did Mr. Brown, and that's the focus of your organizations.

The Bankers Association was one of the many that really supported Bill S-4. They applauded the amendments in the bill that will allow banks and financial institutions to advise public guardians, law enforcement, or family members when they have evidence of financial abuse. I think you touched also on the abuse that may be coming from family members. The banks would now have the discretion in regard to how to deal with these serious situations and protect the vulnerable. That does not exist now.

We also heard from the Privacy Commissioner about the tools necessary for the commissioner to do their job. There was not adequate time for them to be able to act. Now, with the changes in Bill S-4, that would change.

If you could, just touch on how things have changed and on these changes that have been now incorporated in Bill S-4 to update PIPEDA.

Ms. Romanko.

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you.

I want to ask you about information sharing by companies in a prospective business transaction, which would be allowed under Bill S-4 without the knowledge or consent of an individual. Do we need this clause and does it strike the right balance around privacy and the need for businesses to have certain information?

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you.

I want to ask you about breach notification. The threshold is pretty high, it's “a real risk of significant harm”. Do you think that is the right threshold? We've had some witnesses suggesting a two-step system where the Privacy Commissioner is informed of all breaches and then there is a decision about when an individual is notified about a breach. Do you think that the way it is structured now under Bill S-4 it's leaving these decisions to industry itself? Is that the right approach?

[Professor Avner Levin, Associate Professor and Director, Privacy and Cyber Crime Institute, Ryerson University, As an Individual]

Thank you, Mr. Chair. Thank you for the invitation to appear in front of the committee. I apologize that I'm not bilingual, so my comments will be in English. I'm an associate professor and the director of the Privacy and Cyber Crime Institute at Ryerson University and I'm appearing as an individual. I research privacy and I've been privileged to appear in front of the access to information, privacy and ethics committee as well.

I am not going to repeat comments that you heard from earlier witnesses in previous meetings. I take these hearings that the committee is conducting at this time as a sign that the government is interested in considering some amendments to the bill before it proceeds. I would like to reiterate what previous witnesses have said that I think the following amendments should be considered by the committee.

First, I think the committee should consider adding order-making powers to section 12.1 of PIPEDA for the commissioner. Section 52 of the B.C. or Alberta personal information protection act can certainly serve as a model. That does not preclude leaving in the provision for compliance agreements that is in the new proposed bill, which would be the new section 17.1. I'm happy to discuss the reasons for my thoughts on this if we have time for questions later, but other witnesses have already made this point.

Second, I would suggest to the committee that it delete proposed paragraph 7(3)(c.1). That would eliminate the possibility for government institutions to request personal information without judicial supervision. I think that point has also been made by previous witnesses, so I would leave that for questions as well if there's any interest.

Third, I would leave paragraph 7(3)(d) as is. In other words, I do not think the committee should proceed with allowing organizations to share information with other organizations. I think that the committee should leave the investigative body model that is currently in PIPEDA intact and that point has been made.

I would like to spend my time introducing a new point to the committee, as far as I know, and that is regarding the issue of workplace privacy that is in this proposed bill. To the best of my knowledge it has not yet been discussed. Under PIPEDA the personal information of employees of a federal work, undertaking, or business is protected and the collection, use and disclosure of it requires the consent of the employee. That's currently in PIPEDA in paragraph 4(1)(b).

Bill S-4 proposes a new section, section 7.3, that will govern such employment relationships, according to which employee consent will no longer be required. Employers will have to notify employees instead. That's going to be in the new paragraph 7.3(b), but they will be able following this notice to collect, use, and disclose information that, quoting from the bill, “is necessary to establish, manage or terminate an employment relationship.” That's the new paragraph 7.3(a).

In my opinion, as currently worded, this presents an unfortunate erosion of workplace privacy that ignores previous OPC findings as well as Federal Court decisions. I note to the committee there's a decision from the Federal Court for Eastmond and there's another one for Wansink. I can provide the full citations later. The implications are broader than just for federally regulated employees. Labour arbitrators for those employees who are unionized look to PIPEDA as a guidance and as a source, and to the OPC guidelines. Employers in provinces that do not have private sector legislation look to PIPEDA as guidance even though they do not fall under the jurisdiction of PIPEDA directly.

The proposed amendment appears to follow B.C.'s and Alberta's PIPA, but in my opinion it does not. In those provincial laws—and bear with me, please—the collection, use, and disclosure must be reasonable for the purposes that I've listed. For reference, in the British Columbia act, those are sections 13, 16, and 19. I quote from paragraph 13(2)(b) of the British Columbia Act:

the collection is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual.

The new section 7.3 does not refer to the reasonable standard at all. I imagine that's presumably because PIPEDA has built into it subsection 5(3) that says:

An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

I would hope the committee would follow me in seeing that existing subsection 5(3) refers to the purposes being appropriate to the reasonable person, and it does not refer to the collection or the use or the disclosure as being reasonable. If you want to follow the B.C. and Alberta model, of course the collection and use and disclosure should be reasonable. The purposes of managing, and so on, the employment relationship, needless to say, are reasonable already.

In my opinion the current wording in the bill would allow, to take perhaps a little bit of an extreme example, an employer to install closed-circuit television cameras inside washrooms at the workplace, for the purpose of managing the workplace as long as a notice was posted to that effect. I would argue that for the purpose of managing the workplace and wanting in that case to ensure that facilities are clean and well maintained, doing that is reasonable. But the collection of personal information would not be reasonable in that situation. That is the distinction that I wish to draw to the attention of committee members at this point in time, which I don't think has been articulated up to this point.

I would suggest two simple amendments as a result. One would be to simply add the word “reasonable” before “necessary” so that the amended clause, which would create the new paragraph 7.3(a) would read “the collection, use or disclosure is reasonable and necessary to establish, manage or terminate an employment relationship between the federal...business and the individual”. Alternatively you may wish to consider amending the clause by borrowing language used in Quebec's legislative framework. Section 2087 of Quebec's Civil Code requires employers to protect the dignity of employees, so the committee may wish to consider an alternative formulation such as, “the collection, use or disclosure protects the dignity of the individual and is necessary to establish, manage or terminate the employment relationship”.

I'll make one last point on this, Mr. Chair, before I end my comments. I do think that employees cannot meaningfully consent to their employers' practices in an employment relationship. In that sense I do think that it is useful to move to regulating employers' conduct in those circumstances. I could add more on the issue of consent, but again I think you've heard from earlier witnesses in previous meetings.

I will leave it at that regarding the point on privacy at work. I would be happy to answer questions if there is any time.

Thank you again for the invitation to appear today.

[Janet Cooper, Vice-President, Professional Affairs, Canadian Pharmacists Association]

Thank you.

Good morning. My name is Janet Cooper. I am a pharmacist and I am vice-president of professional affairs with the Canadian Pharmacists Association. I am pleased to be here today to discuss Bill S-4, an act to amend PIPEDA.

CPhA, the Canadian Pharmacists Association, is the national voice for Canada's 39,000 pharmacists. Pharmacists practise in a range of settings, including community pharmacies, hospitals, academia, industry, and government.

CPhA and the pharmacy profession have a long history of speaking out for the interests of patient privacy and confidentiality, and as far back as 2001 CPhA was involved with a privacy working group of other health care provider organizations that provided advice to Health Canada on privacy matters related specifically to health care. Since then we've appeared before parliamentary committees on numerous occasions to offer our perspective on PIPEDA changes.

Today pharmacists' commitment to privacy is reflected in the professional codes of ethics and standards of practice that guide our profession, as well as CPhA's own privacy code for pharmacists. Given that pharmacists routinely dispense more than 11 million prescriptions each week and they're conducting a range of new, expanded services for patients in almost all jurisdictions, the need for ensuring confidentiality of patients' personal information has never been greater.

Community pharmacists were very early adopters of digital records, having maintained computerized medication profiles for more than three decades. Most of the 600 million prescriptions that are dispensed each year, which is close to $30 billion in spending, are actually sent electronically for claims adjudication by public drug plans or private insurers. So there is a lot of electronic transmission of patients' medication information.

Increasingly, Canadians' medical records are maintained electronically by other health care professionals as well, including physicians' records, lab test results, and diagnostic images. The goal of electronic health records is to increase accessibility and sharing of patient information by those providers who need access to inform patient care and to support interprofessional collaboration.

For example, in several jurisdictions, drug information systems, or DIS, are in place to allow access to a complete profile of medications regardless of which pharmacy dispensed the prescription. This improves safety and efficacy of medications, supports improved prescribing, supports detection of adverse drug events, and deters prescription drug abuse. We hope that in the near future all prescriptions will be electronically created and then transmitted to the patient's pharmacy of choice. With this change to electronic health records comes increased need to ensure that Canadians' private health and medication records are protected.

Let me state up front that CPhA supports the amendments in Bill S-4 as they relate to protecting personal health information. There are two amendments in particular that we want to address.

First, CPhA supports the amendment in the bill in which personal information may be obtained without consent for the purposes of communicating with the next of kin or authorized representative of an injured, ill, or deceased individual.

Pharmacists, as well as any health care provider, may find themselves in the difficult situation of having to deal with patients who may be severely ill, unconscious, or incapacitated for any number of reasons. In such circumstances it may be imperative for the pharmacist or other health professional to immediately contact family members or next of kin to inform them of the patient's condition, or to seek valuable information on the patients' medical history. But seeking permission or consent to contact those individuals in advance may simply not be reasonable nor in some cases possible. This clause would provide pharmacists and other health care providers with the comfort and knowledge that in the case of a severe health emergency they will not be in contravention of PIPEDA for acting in the best interests of their patients by contacting next of kin or authorized representatives.

Second, CPhA also supports the amendment in Bill S-4 requiring organizations that have encountered a privacy breach to report that breach to the Privacy Commissioner and notify individuals, if it is reasonable in the circumstances to believe that a breach creates a real risk of significant harm to an individual.

For pharmacists who access a significant amount of sensitive information related to the medication and health of their patients every day, a breach or disclosure of this information has the potential to put the patient at risk. Patients who are on medications for HIV, mental illness, or infectious diseases would certainly not want all of that information to be known. As defined in the legislation, this risk could include threats to employment, reputation, or relationships. As a result, CPhA believes that, should a privacy breach occur, reporting this breach to the individual concerned and the Privacy Commissioner are reasonable steps to take in order to mitigate any risk that may occur.

It's also reasonable for the organization in question to maintain proper records of these occurrences as stated in the bill.

Although not specifically related to this bill, I want to thank Health Canada for introducing a regulatory change this past summer that will better enable pharmacies to protect privacy. There's a requirement in the Food and Drugs Act that requires pharmacists to maintain up to two years' worth of prescription records, and until last summer the regulation required prescriptions to be maintained in hard copy format even though more and more prescription records are now retained in electronic format. Last July Health Canada reinterpreted that regulation to allow for electronic retention of prescriptions. In addition to being more efficient for pharmacies, electronic retention is safer and more secure from a privacy standpoint.

Thank you, Mr. Chair and committee members, for the opportunity to meet with you today to discuss Bill S-4. I'd be pleased to respond to your questions.

[Douglas Brown, Public Guardian and Trustee, Public Guardian and Trustee of Manitoba]

Thank you for the opportunity to comment on Bill S-4, the digital privacy act. I'm Douglas Brown, the public guardian and trustee of the Province of Manitoba.

My comments today will be limited to subclause 6(10) of the bill, which would amend the Personal Information Protection and Electronic Documents Act to permit the disclosure of personal information about an individual by an organization to a government institution in circumstances where there is a suspicion that the individual may be a victim of financial abuse. The Public Guardian and Trustee of Manitoba supports the amendment as a positive step that strikes the necessary balance between the need to maintain privacy of personal information and disclosure of that information to potentially identify and stop what are the devastating consequences of financial abuse.

The Public Guardian and Trustee of Manitoba, or PGT, is a corporation sole established under The Public Guardian and Trustee Act of Manitoba, that operates as a provincial government special operating agency. The PGT manages and protects the affairs of Manitobans who are unable to do so themselves and have no one else who is willing or able to act. This includes mentally incompetent and vulnerable adults, deceased estates, and children. The PGT manages approximately 5,800 clients, estates, and trusts, with approximately $230 million of assets under administration by our office.

The PGT becomes involved in the management of an individual’s financial affairs in a variety of ways. Most frequently, the PGT is appointed by the chief provincial psychiatrist under The Mental Health Act or by an order issued under The Vulnerable Persons Living with a Mental Disability Act, both Manitoba legislation. The PGT can also be appointed by a judge of the Court of Queen’s Bench of Manitoba to act in various circumstances. When the PGT does become involved, an investigation is conducted to gather and record the assets owned by the individual for whom we're now managing affairs. This includes all their property, investments, and any accounts at financial institutions. Unfortunately, in some situations our investigation will uncover evidence of possible financial abuse. In the worst of these situations, the financial abuse has resulted in all or a large part of the finances of that individual having been lost.

The impact of these losses caused by financial abuse cannot be overstated. As you or I choose to save, invest, or plan for our retirement and anticipate having the financial resources to be independent and exercise some level of control over our affairs in the future, people who have been the victim of financial abuse have lost that independence and have lost that control over their futures. Often we see that the health and well-being of the victim of financial abuse can be negatively impacted. More often than not, a victim of financial abuse has little chance of recovery. In many cases the money is gone, and there is little likelihood of recovering the money from the perpetrator of the abuse.

Organizations such as financial institutions can play an important role in detecting possible financial abuse through their ongoing contact with the public. My experience is that these institutions do want to cooperate with government institutions when they have a suspicion of financial abuse. While the privacy objectives of the existing legislation are clearly important, privacy laws should not become a tool used by perpetrators of financial abuse to avoid detection. Amendments that allow for a controlled disclosure of personal information in limited circumstances can still maintain privacy objectives while also providing an additional set of eyes out in the community to help identify and hopefully stop cases of financial abuse. I would strongly recommend to this committee that this is the right result.

In reviewing the amendments and the various submissions that have been made to the committee, there are a couple of recommendations that I would also support.

First is that the definition of “government institution” needs to be clear. The PGT or similar agencies in other provinces or territories have a role in these situations, and should be included in the definition. There should be caution taken not to apply the definition too narrowly, as this could discourage the reporting of information. A reasonable check and balance to apply could be to look at the role and use of the information that could be made by the institution that is receiving the information. In the case of the PGT, we're subject to provincial privacy laws. We also have specific statutory authority that allows us to collect information that would otherwise be private where it's required to carry out our duties, responsibilities, and powers. By having that control, you've put some control over how the information could be used once it's received by a government institution.

Second, in most cases the perpetrator of financial abuse has to gain the trust of the victim before the abuse can begin. This unfortunately means that relatives and family can often be the perpetrators of financial abuse. Any requirement to report suspected financial abuse in all circumstances to next of kin may place the victim at greater risk. Organizations that are contemplating making a report should have some discretion in those situations, and where appropriate, should make the report only to a government institution and not to the next of kin in circumstances where the next of kin may be involved in the abuse.

Third, in some cases an individual may not be a victim of financial abuse but is no longer capable of managing his or her affairs. The indicators of financial abuse and financial neglect can often be the same, so an organization that's contemplating whether to report should have the ability to report suspected financial abuse even though it may not be clear where the unusual financial activity originates, or whether the irregular financial activity is a result of a third party or the individual himself or herself. The organization should not be required to make this determination before it has the ability to make a report to a government institution. The loss of financial independence resulting from neglect is just as significant as a financial loss caused by a third party, so again, it's in everybody's interest that the matter be identified and dealt with as quickly as possible.

In conclusion, while the privacy objectives of the existing legislation are clearly important, the benefit of permitting disclosure of personal information in a limited and controlled manner would be a positive step in detecting and hopefully stopping cases of financial abuse.

Thank you.

[Catherine Romanko, Public Guardian and Trustee, Public Guardian and Trustee of British Columbia]

Thank you, Mr. Chair.

Good morning. I am the public guardian and trustee of British Columbia. I thank you for the opportunity to comment on Bill S-4 today. In addition to my oral comments, I have provided a written submission. My comments today are restricted to subclause 6(10) of Bill S-4, and that is with respect to the proposed provision that will enable federally regulated organizations and in particular financial institutions to report concerns of potential financial abuse of a customer, without the knowledge or consent of the customer, to a government institution with authority to investigate and to take appropriate responsive action.

The jurisdiction to respond to suspected financial abuse typically falls to provincial authorities and territorial authorities with respect to civil investigation and in particular to public guardians and trustees across the country. The Public Guardian and Trustee of British Columbia has participated in the multi-year consultation process that led to the development of the anti-financial abuse provisions in subclause 6(10). My office supports the objective of the proposed anti-financial abuse amendment and offers three recommendations for refinement of the provision to ensure that the provision is effective, and secondly, to minimize the risk of harm to an individual who is the subject of a report and a potential victim of financial abuse.

My recommendations are based on the experience my office has in responding to financial abuse and I will provide those recommendations at the conclusion of my comments.

By way of background, the Public Guardian and Trustee of British Columbia is a statutory corporation sole created under the laws of the province. My office provides fiduciary and protective services to vulnerable adults, to persons who are mentally incapable, to minor children. We administer the estates of deceased and missing persons when there is no one else able and suitable to do that. We serve approximately 29,000 clients and administer almost $900 million in private client assets.

Among the various statutory functions given to the Public Guardian and Trustee under British Columbian law is the role of investigating allegations of financial abuse, including financial neglect and financial self-neglect of mentally incapable adults. The definitions of financial abuse, financial neglect, and financial self-neglect, which guide the investigations of the Public Guardian in British Columbia, are set out in legislation, but generally speaking, abuse is an action committed by a third party. Neglect is the failure of a third party to act, and self-neglect is an individual's own failure to manage his or her own affairs due usually to mental incapacity.

When my office receives information that an adult may be mentally incapable and may be a victim of financial abuse, the Public Guardian and Trustee of British Columbia has a legislative mandate to investigate the circumstances. My office has the powers to seek disclosure of financial information from legal representatives such as an attorney acting under an enduring power of attorney, and from financial institutions where an adult may hold assets. If my office has reason to believe that the adult's assets are in need of immediate protection, the Public Guardian and Trustee of British Columbia has the authority to instruct financial institutions to, in essence, freeze bank accounts to stop any withdrawals from the accounts or transactions with respect to those accounts, to halt the sale of property, and to take any other reasonable step necessary to protect the adult's assets from dissipation or misappropriation.

Each year, my office responds to approximately 1,600 allegations of suspected financial abuse. Approximately 1,200 of those cases result in a full investigation by my office, and of approximately 400 cases, the Public Guardian and Trustee is appointed committee of estate as a result of the investigation, and that is for the purpose of acting as property guardian to manage the financial and legal affairs of the adult on an ongoing basis.

The experience of my staff in responding to allegations of financial abuse has highlighted for us the critical role played by financial institutions in identifying issues of potential financial abuse and ensuring that vulnerable adults receive the support and assistance they need when it is required in order to curtail or end the financial abuse.

Employees of banks are often in the best position to observe potential financial abuse as a result of ongoing personal contact with their customers and with their knowledge of the customers' financial affairs. While it may be best practice for a bank employee to communicate with a customer directly about concerns of potential abuse, in many cases such communication is simply not practical, nor is it prudent. In some instances, bank customers may have diminished mental capacity due to mental illness or due to diseases of aging, making direct communication with a customer challenging and often ineffective.

In other cases, a customer may be unduly influenced by or subject to the control of another person, so that advising the customer of suspected financial abuse may in fact alert the abuser to the fact that the abuse has been discovered and put the customer at greater risk. Currently, PIPEDA permits financial institutions to report financial abuse to relevant authorities, such as the police, where the financial institution has reasonable grounds to believe that a law has been contravened.

However, if no law is contravened, federally regulated organizations are restricted by the act as to what actions they are permitted to take even if financial abuse is suspected, so my office of course is responding to allegations of abuse, not certainties. No crime has been committed as yet. Enabling financial institutions to proactively report concerns of potential financial abuse to an organization such as the Public Guardian and Trustee of British Columbia, with the legislative authority to investigate and to take steps to protect the assets of the vulnerable adult if necessary, is critical in the effort to reduce the incidents or continuation of financial abuse.

The Public Guardian and Trustee of British Columbia offers three recommendations for refinement of the proposed legislative amendment in proposed paragraph 7(3)(d.3) of PIPEDA. They are as follows.

One, specify that provincial authorities, and in particular public guardians and trustees, who are authorized to respond to financial abuse, are included in the term “government institution” to which an organization may report financial abuse. The term “government institution” is currently not defined in PIPEDA, nor is a definition proposed in Bill S-4.

The difficulty here is that the act is a federal legislation governing federally regulated bodies. Public guardians and trustees fall under provincial jurisdiction. We want to ensure the legislation is clear that reports may be made to provincial bodies. The act contains regulation-making power, which would permit the creation of a regulation to define “government institution”.

Making it clear that organizations are authorized to report to provincial and territorial government institutions, and in particular public guardians and trustees across the country, will assist financial institutions in effectively reporting. Another alternative, of course, would be simply to provide the definition directly in the act. Either way, the definition would be very useful.

Two, delete the reference to “next of kin” from the list of individuals and government institutions to which organizations may report concerns of potential financial abuse. The perpetrators of financial abuse, particularly with respect to vulnerable adults, are often next of kin. Disclosure of concerns of potential financial abuse to next of kin may have the effect of alerting the abuser to the fact that the abuse has been discovered and may in fact end up putting the vulnerable adult at greater risk of harm—or at least the adult's assets at greater risk of harm.

Three, explicitly recognize financial neglect and financial self-neglect in proposed provisions, along with financial abuse. Many provincial authorities have statutory power to investigate and assist individuals who are victims not only of financial abuse but of financial neglect and financial self-neglect, the effects of which can be equally devastating. In fact, the indicators of potential financial difficulty are the same, whether it's abuse, neglect, or self-neglect. Permitting financial institutions to report concerns of financial abuse, neglect, and self-neglect of their customers, I submit, would protect the interests of vulnerable British Columbians.

Those are my comments. Thank you very much. I'd be pleased to answer questions.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I have a question for Mr. McLinton and Mr. Littler.

Bill S-4 provides for a mechanism to notify individuals of security breaches. You appear to support that. The model proposed under Bill S-4 will require organizations to, themselves, determine whether the breach creates a risk of significant harm to the individual or not. Do you think it would be easy for your members to make that assessment? Do you expect to receive some support to ensure you are properly complying with the bill's provisions?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

We received a letter from the privacy commissioner indicating that Bill S-4 was based somewhat on B.C.'s model. That is what it was supposed to look like, but suggestions changed in light of the report. I think that calls into question the provisions in Bill S-4. Would you agree with that? Do you think we should find a way to bring the bill in line with the report recommendations as well, in order to achieve that alignment between the acts?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

I will go back to the banking association. Financial institutions also provide insurance coverage for loans. What aspects of PIPEDA or Bill S-4 prevent the banking system from accessing the metadata or medical information on an insurance applicant under that same umbrella with the banks? The reason I ask is, the bank lender knowing a client's medical information could prejudice the lender. What you had stated previously is that you'd like to have more sharing of information to prevent a crime. How does the customer know that this barrier will not be crossed?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Ms. Sali, I'm going to read a comment made by your executive director. I'm going to read the quote in English as I don't have it in French. It reads as follows:

...this legislation, while welcome, does almost nothing to tackle the serious problem of ongoing government surveillance against law-abiding Canadians.

Since we are studying the bill before second reading, we have the ability to propose amendments to PIPEDA that don't necessarily appear in Bill S-4. I see that as a golden opportunity. Unfortunately, the government seems convinced that the bill is going to pass as is, regardless of the amendments suggested by all the witnesses. That's truly unfortunate.

In light of your executive director's comments, do you think the committee could improve certain aspects of the bill?

[John Carmichael, Conservative, Don Valley West, ON]

—and when there is an opportunity for somebody to report, you want to know that the report is going to fall on ears that are able to listen and respond.

Going over to the Retail Council, I'd like to refer to your opening comments on consent in Bill S-4. In this paragraph you say, “We note that the bill contains a provision specifying that 'Consent is not valid unless how the information will be used is clearly communicated in language appropriate to the target audience.'”

Could you expand on that and talk to how that is going to benefit your membership?

[John Carmichael, Conservative, Don Valley West, ON]

Bill S-4 provides that ability for you.

I think it's important, because this is an area we all know is growing—

[Linda Routledge]

The banks generally speaking would see potential or suspected financial abuse in the branches. It could be a client coming in with a caregiver or whoever and there being some kind of suspicious transaction. Right now, the first step of the bank would be to try to take that client aside so that they get them away from the suspected abuser, so that they can determine what the client wants to do. But in some cases that's not possible, and so we just have a suspicion.

Many times the amount of money may not be large in that instance, and that instance may not be fraud. We are constrained in being able to approach the police or the public guardian and trustee to ask for their assistance, because there is not a contravention of the law or fraud.

What we're looking for, and what Bill S-4 is giving us, is the ability to then escalate this matter and have it investigated further—because within the banks there is an escalation process—so that we can assess whether there is somebody else out there we can contact who would be able to help our customer avoid the abuse. It may be a parent, a sibling, or someone like that. We would assess and try to determine to the best of our ability whether that person is involved in the abuse—we recognize that in many cases it's a family member—and we would do our utmost to determine that the person we're contacting is not involved in the abuse.

That is where Bill S-4 would help.

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Chair.

Welcome to our witnesses.

I'd like to begin with the Canadian Bankers Association. Feel free to determine who answers.

In your opening comments you talked about financial abuse, specifically of our most vulnerable. In your comments you said that PIPEDA limited you in much of what you would report when you saw a potential senior abuse or elder fraud, something going on that was inappropriate.

My understanding of Bill S-4 is that much of the remedy for this is now in place. I wonder whether you could talk to what works and what doesn't work to assist you so that your members can support and improve the situation of those most vulnerable clients.

[Karl Littler]

That's correct. There are a number of specific provisions in this bill that we do support, and I had noted especially the business contact information exemption, which is significant here. We are supportive of the sort of alternative route, if you like, of voluntary compliance agreements. There are other aspects in here. On balance, if the section that is intended, although does not explicitly state that it covers protection of vulnerable persons, is to proceed, we would hope to see some elucidation of that on the regulatory side, but, on balance, we would support Bill S-4 moving forward.

[Mark Warawa, Conservative, Langley, BC]

Would Bill S-4 improve protection for seniors and vulnerable groups?

[Mark Warawa, Conservative, Langley, BC]

You are generally in favour of Bill S-4 moving forward. Is that correct?

[Mark Warawa, Conservative, Langley, BC]

Thank you, Mr. Chair.

Thank you to the witnesses.

My focus and my questions will be on dealing with privacy issues and moving forward.

As you know, PIPEDA became law in 2000. It came into force over 2001 to 2004 and there is a statutory review on most federal legislation and that statutory review took place, I believe, in 2006 or 2008. My question is going to be focusing on whether we should continue to discuss potential amendments to this or we should move forward and get general consensus on Bill S-4 and move it forward. Or do we not move forward on Bill S-4 and ask the next parliament to deal with this.

As we heard from you, Mr. Chair, you're recommending that we start clause by clause on the 31st, because what we've heard, in submissions and from the witnesses, is that there's general support for Bill S-4, from the public and from the witnesses. There are some suggested amendments but some of these changes can be done by regulation following the amendments and passage of Bill S-4 if it does happen. We have a very short window to pass it in this parliament. If we don't, it will be the next parliament and we've already been at work on this almost a year.

That's going to be the focus of my question. Do we move forward or are you suggesting that we not move forward?

I'm going to first go to the Canadian Bankers Association. You were quite involved in the judicial review. You appeared before the committee to express a general support for PIPEDA and then you made a number of recommended changes that are in Bill S-4. Could you highlight some of those changes that you are happy with that are included in Bill S-4?

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you.

We heard that the federal bill S-4 is based on the Alberta and B.C. bills, but it's our understanding that B.C. recently conducted a review of PIPA, its provincial legislation, based on the Spencer decision at the Supreme Court. We heard from Vincent Gogolek at our last meeting from the BC Freedom of Information and Privacy Association. He said that what happened was the scope of PIPA, the B.C. law, was narrowed. Now the minister, Minister Moore, feels that Bill S-4, this current bill, is in compliance with Spencer. You seem to have a different point of view. Can you clarify that?

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you.

Bill S-4 includes new provisions that will assist organizations in preventing and combatting fraud. How will these provisions further assist and facilitate these activities? This is directed to the banking association.

[Joe Daniel, Conservative, Don Valley East, ON]

I think the other thing is, there are many things that are hidden in there such as marketing use of your data, etc., that you're signing off on, which is not necessarily something you want to do.

My next question is to the Retail Council of Canada.

You have stated that support to risk-based approach to data breach notification on individuals.... Would you say that Bill S-4 sets appropriate thresholds for notification for individuals?

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you, Chair.

Thank you, witnesses, for being here.

My first question is to Ms. Sali.

Do you think that Bill S-4's new provisions on valid consent will strengthen the protection of children's online personal information, in fact, anybody's information? A lot of the time the consent that you're actually looking for is so complex that I don't know anybody who has actually read through it all.

Would you like to comment on that?

[Karl Littler, Vice-President, Public Affairs, Retail Council of Canada]

Thank you, Mr. Chairman.

I think most members will be familiar with RCC, which has been the voice of retail in Canada since 1963. As a not-for-profit industry association, we represent over 45,000 storefronts on a national basis, of all formats ranging from independent through grocer, online, and mass merchandise merchants.

We appreciate the committee's invitation to appear today. While we're not in as strong a position as my friends here from BCCLA and OpenMedia to comment on the legal intricacies of Bill S-4, we would be pleased to provide some general observations from a retail perspective.

Retailers are generally supportive of the proposed legislation, but do believe that it could be improved upon in some areas, which I and my colleague will address.

Generally speaking, Bill S-4 strikes the right balance between action to protect digital privacy on digital fraud and financial abuse, while recognizing the strengths of PIPEDA and its forward-thinking technologically neutral approach. More specifically, we support the clarification on the exclusion of business contact information, as this was clearly not meant to be captured. This section 4 clarification will better equip businesses to conduct their ongoing operations. We also support the provision for more flexible resolutions to breaches of the act's requirements, notably the provision for voluntary compliance agreements in section 15. We also support the reasonable belief basis for reporting in proposed section 10.1.

Turning to the issue of consent in section 5, we do note that it provides that consent is not valid unless how the information will be used is clearly communicated in a language appropriate to the target audience. We certainly agree with the principle. We understand this is the target of that section, that a vulnerable population such as children should be protected.

We don't take the position that some previous witnesses have that this proposal is superfluous and should be withdrawn. That said, we would encourage the inclusion of a provision for regulation to specify which vulnerable groups are covered. While it may be challenging to do so, a regulation could specify a non-exhaustive list including the obvious examples of minors through to those with cognitive disabilities and those lacking full fluency in the language in which they're being served. Further from that, non-prescriptive guidance from the commissioner's office on appropriate best practices would provide practical guidance for merchants.

With regard to record-keeping, we note that proposed section 10.3 requires that records of breaches be kept in a manner prescribed by regulation. Retailers encourage the inclusion of a materiality test for record-keeping specifically, as it would allow for greater certainty and would tend to limit onerous and less helpful record-keeping, where a breach has occurred technically but without any reasonable prospect of material harm. We're thinking of instances like a computer screen being left unattended or a filing cabinet being left open, where a third party may have passed by. We want to avoid the trivial and ensure that there is some material requirement here for the keeping of records.

We would also suggest including a provision specifying a reasonable length of time for record-keeping, perhaps one year, but we're obviously open in that regard. What we don't want is an obligation to keep records in perpetuity, where they may be diminishing in use from the perspective of the public good and would be onerous for merchants to maintain.

With your indulgence, Mr. Chair, my colleague, Jason McLinton, will make two further observations and conclude on our behalf.

[Meghan Sali, Campaigns Coordinator, OpenMedia.ca]

Thank you, Mr. Chairman.

Good afternoon, my name is Meghan Sali. I'm here today on behalf of OpenMedia, a non-profit organization working to safeguard the digital rights of Canadians. I'll structure my remarks today by focusing primarily on a critical issue within Bill S-4, which, if passed in its current form, could expose Canadians to an unwarranted exploitation of their private data.

Subclause 6(10) proposes to expand voluntary disclosure of sensitive information by a private company, most notably in our estimation, by telecom providers. It would also allow for involved service providers to offer this information to anyone without the consent of the individual.

Today I will briefly cover a few points central to this issue, including the sensitivity of basic subscriber information, the overly broad disclosure framework in Bill S-4, and the lack of trust concerning the entities seeking disclosure.

Flagging a common use case for such provisions, I would ask you to imagine a private company seeking to sue the customers of Internet service providers based on the anonymous online activities they see. Before they can proceed, this company would like the ISP to identify who is behind the IP address, by voluntarily turning over basic subscriber information. Considering that a report issued by the Privacy Commissioner just last year outlines how online identifiers can be extremely revealing, potentially conveying information about a person's medical status, religious views, sexual orientation, political affiliation, and more, the argument against this information being considered “basic” is extremely compelling.

As you know, Bill S-4 also comes on the heels of a Supreme Court of Canada ruling that Canadians have a reasonable expectation of privacy with regard to this type of information. In the Spencer ruling, with regard to IP addresses, the Supreme Court stated:

The user cannot fully control or even necessarily be aware of who may observe a pattern of online activity, but by remaining anonymous — by guarding the link between the information and the identity of the person to whom it relates — the user can in large measure be assured that the activity remains private...

Or as a supporter, Shawn, wrote on our website:

We have a right to privacy, and to not be subjected to criticism or surveillance based on meta data.

Additionally, a number of courts have spoken out about the need for privacy protections to prevent abuse by private companies trying to sue the customers of ISPs. As with previous presentations, OpenMedia invited citizens to share their concerns concerning Bill S-4, and to help shape my testimony today. I think it's important for MPs to put the lived experience of Canadians front and centre in these deliberations.

Dave Carter had this to say in a comment submitted on our website:

No company, public or private should have a right to access my personal, private information without following due course of procedure through obtaining a court approved warrant. This is akin to a stranger cutting the keys to your house and letting themselves in whenever they want to snoop through your socks and underwear drawers.

I will now move on to my second point. The framework under Bill S-4 allows disclosures for the purpose of investigating the breach of an agreement, or a contravention of the laws of Canada or a province, that has been, is being, or is about to be committed. Experts and the Privacy Commissioner have indicated this framework is overly broad, and that allowing the voluntary disclosure of personal information, simply on the basis of an investigation, could lead to a violation of privacy rights. Disturbingly, the scope of such private investigations is not defined in this bill.

As supporter K.A. told us on our website:

A law letting a private company share individuals' private information on the mere suspicion of wrongdoing is just too broad a power to have. This is putting a private company, even one with a vested interest in certain outcomes...to become an accuser, judge and jury, for unsuspecting individuals.

This brings me to my final point, which centres on the issue of trust. As I've mentioned, if we were to disclose data that is highly sensitive based on a very loose framework, with no oversight, accountability, or citizen consent, I would expect we would generally have a great deal of trust in the ethics of the entities involved. This bill comes at a time when our copyright notice and notice rules, just implemented in January, are being exploited and distorted. Specifically, media entities and their firms have been sending misleading, and in some cases flagrantly abusive, copyright infringement notices to Canadians. Many of these notices threatened massive lawsuits of up to $150,000, demanded settlements from individuals before any court proceedings, and even threatened users with being kicked offline for unproven accusations of infringement. Some of the notices even mentioned online activity that the user had never engaged in, let alone acquired related files.

One supporter, who asked to remain anonymous, told us in an email:

l...have received two copyright infringement notices from IP-Echelon which...have accused me of downloading HBO's "Girls", a show I have definitely never heard of.

Another supporter, coincidentally accused of downloading the very same HBO show, forwarded us his reply to TELUS, his ISP. He says:

I do not know of this show and have no record of downloading or streaming such a show. As the letter is threatening in content and provides no proof of the claims it makes, I would like it if you would provide me with the proof of such an event taking place.

Since January 2015 OpenMedia has seen more than 11,000 Canadians speak out on this issue through our website alone. Thankfully, rights holders and their firms do not have the personal information associated with the IP address, where the notices are being sent. This critical element of our notice and notice provisions maintains that a private entity must obtain a court order to access the personal information of a subscriber. Bill S-4 would undermine this clearly necessary safeguard and associated oversight with a court of law.

The question before you now is, knowing how some firms have already abused our notice and notice provisions, why would we give them unauthorized access to the sensitive personal information of innocent Canadians? Why leave our privacy rights in their untrustworthy hands?

In conclusion, I would like to say that we applaud the steps taken by this government, in particular on telecom and copyright issues, to ensure that customers are treated fairly and respectfully by companies that provide services to Canadians. However, this positive legacy will be put at risk by allowing subclause 6(10) to stand, as more Canadians are exposed to privacy breaches and potentially harassing demands from companies that have demonstrated they are not deserving of our trust.

Thank you for your time, and I'd be happy to answer questions.

[Linda Routledge, Director, Consumer Affairs, Canadian Bankers Association]

Thank you, Mr. Chair, and thank you for having us here today.

The banking industry has long been a leader in privacy protection. Given the nature of the services that banks provide to millions of customers in communities across Canada, banks are trusted custodians of significant amounts of personal information. Privacy and protection of clients' information is a cornerstone of banking. Banks take very seriously their responsibility to protect customers' information and are committed to meeting not only the requirements of privacy laws, but also the expectations of our customers.

We are pleased to have this opportunity to voice our support for the many provisions in this legislation, including the new breach notification and the financial abuse provisions. We are concerned that amendments to eliminate investigative bodies will create uncertainty and may significantly limit the type of information that banks currently share to prevent criminal and terrorist activity.

The banking industry supports the requirements in the digital privacy act for organizations to notify individuals about a breach of their personal information where there is a risk of significant harm. ln fact banks already notify clients in the rare instances of such a breach so that individuals can protect themselves from fraud or any other misuse of their personal information. We are in favour of reporting material breaches to the Privacy Commissioner. We also support the commissioner's new oversight powers to ensure that organizations comply with these new provisions.

We look forward to working with the government on guidance and regulations to set out the details of how these provisions will be implemented, thereby providing an effective framework to ensure that Canadians are notified in a timely manner. lt is important for all stakeholders to work together to protect the personal information of individual Canadians, and Bill S-4 effectively creates a framework for this to happen.

The CBA has long advocated for amendments that will help seniors and vulnerable Canadians from becoming victims of financial abuse. We applaud the government for including an important amendment in Bill S-4 that would allow banks to notify a family member or authorized representative in suspected cases of financial abuse. When bank employees see situations in the branch that suggest potential financial abuse, it is the customer's savings that are at risk, and bank staff want to be able to help them to avoid financial abuse.

At present PIPEDA only allows a bank to report suspected cases of financial abuse to a government institution, such as the police or the public guardian and trustee, and only where there are reasonable grounds to believe that a law has been contravened. The suspicious behaviour that bank staff may witness may not necessarily suggest that a law has been broken. lt can still be a case of financial abuse and yet banks are constrained in what they can do to help their clients. Even when banks suspect unlawful behaviour, and are able to report the suspected abuse, they are often told that police or the public guardian and trustee do not have sufficient resources, or sometimes even the mandate, to undertake an investigation on financial abuse.

Our support for this provision is guided by the best interest of our customers, particularly groups most susceptible to financial abuse such as seniors. Banks want to ensure that their staff have the ability to protect their customers from financial abuse, and this provision is an important tool in this regard.

While we are supportive of the majority of the provisions in Bill S-4, we are concerned that some of the proposed amendments may hinder the ability of banks to protect our customers, our employees, our communities, and the financial sector from crime.

Current regulations under PIPEDA contain a list of designated investigative bodies through which organizations can share personal information under conditions set out in the act. The CBA's bank crime prevention and investigation office, or BCPIO, was among the first investigative bodies approved by the government, and it has been in operation for almost 15 years. The BCPIO's information-sharing policies and procedures across organizational boundaries are clearly understood by Canadian banks, along with other participating financial institutions. lt is this formal relationship that allows banks to detect, prevent, and suppress criminal activity such as theft of data and personal information, criminal breach of trust, proceeds of crime, money laundering, terrorist financing, cybercrime, bank robberies, and physical attacks on critical infrastructure.

The bill proposes to replace designated investigative bodies with a framework for the disclosing and sharing of personal information among organizations. ln our view, the new provisions, particularly the wording of proposed provision 7.(3)(d.2), may not allow banks the same scope as the investigative bodies to detect, prevent, and suppress the full range of criminal activities. ln particular, we are concerned that the proposed change limits disclosure to circumstances where it is “reasonable for the purposes of detecting or suppressing fraud or of preventing fraud”. Many of the criminal activities I listed earlier are just not captured by the term “fraud”.

If these provisions are passed in their current form, we believe the ability of the banks to protect the financial system and our customers from criminal activity may be severely hampered.

We ask the committee to consider amending the bill to allow approved investigative bodies such as the BCPIO to continue with their important work. Alternatively, if the committee wishes to maintain the proposed approach in Bill S-4, we recommend that the legislation be amended to ensure financial institutions can share the information needed to detect and prevent other types of serious criminal activity beyond fraud.

ln closing, we want to reiterate the banking industry's support for many aspects of Bill S-4 and ask the committee to consider amending the bill to help protect Canadians from financial crimes.

We would be pleased to answer your questions.

[Micheal Vonn, Policy Director, British Columbia Civil Liberties Association]

Thank you, Mr. Chair.

Again, my name is Micheal Vonn. I'm the policy director of the British Columbia Civil Liberties Association. We are of course a non-partisan, non-profit society and one of the oldest and most active civil liberties and human rights organizations in the country. Privacy is a key portfolio of our association, so we are very grateful to be asked to speak to you today on Bill S-4 and particularly pleased that we are able to discuss it with you prior to second reading, while the scope of the bill is still open for discussion.

Our association would like to support and echo many of the concerns and recommendations that have already been brought before this committee by civil society and academic witnesses. For example, we strongly support the position of B.C. FIPA that there is an urgent need to bring federal political parties under PIPEDA.

We also endorse the position of the national PIAC that compliance agreements are of limited assistance in protecting Canadians' privacy rights and that it is long overdue for the federal Privacy Commissioner to have order-making powers, like provincial counterparts. We believe lt is unacceptable that statutory privacy rights that courts characterize as quasi-constitutional are regulated federally largely on the basis of moral suasion without effective enforcement. ln our view, Bill S-4 falls far short of addressing this critical and long-standing problem.

However, time being limited, I will devote my prepared remarks primarily to the Supreme Court of Canada's decision in R. v. Spencer and its implications for Bill S-4.

The Spencer decision, as you know well, dealt with the provisions of PIPEDA that allow for disclosure without consent to government institutions when the institution has identified its lawful authority to obtain the information. The issue in the case was whether the police seeking access to subscriber information without a warrant from an Internet service provider had the requisite authority. The answer to that question depends on whether there is a reasonable expectation of privacy in customers' subscriber information.

The Supreme Court of Canada resolved this issue, on which lower courts had been divided, and found that there is a reasonable expectation of privacy in subscriber information and that it is reasonable for Internet service users to expect that a simple request by police would not trigger an obligation to disclose information or defeat PIPEDA's general prohibition on the disclosure of personal information without consent.

For the purposes of our section 8 charter right to be secure against unreasonable search and seizure, a request by a police officer that an Internet service provider voluntarily disclose subscriber information amounts to a search, and a warrantless search is presumptively unreasonable, according to section 8 analysis that you will find in R. v. Collins. The crown bears the burden of rebutting this presumption by showing three things: one, that the search is authorized by law; two, that the law itself is reasonable; and three, that the search is carried out in a reasonable manner.

Now, the question in Spencer was whether or not the provision in PIPEDA ostensibly allowing for disclosures without consent to law authorities was in fact a law authorizing this. The court said it was not. If it were, the court said, in paragraph 70: ...PIPEDA's protections become virtually meaningless in the face of a police request for personal information....

The court said that of course the police have lawful authority to ask questions relating to matters that are not subject to a reasonable expectation of privacy and of course they have lawful authority to conduct warrantless searches where there are exigent circumstances. But “lawful authority”—that language in PIPEDA as it stands—requires more than a bare request. This we know from Spencer.

Thus we say that there is a need in Bill S-4 to amend the provision that is at issue in Spencer, a provision so confusing that we had to go all the way to the Supreme Court of Canada to have it definitively interpreted. And while some very limited and narrow voluntary disclosures may still be viable under this provision post-Spencer, outside of exigent circumstances such disclosures would require legal advice.

lt is patently unreasonable to maintain a provision that cannot be understood on its face and requires a charter analysis to be used appropriately. As we argued in our lawful access report of 2012, the best approach is to remove this provision in its entirety.

Alternatively, we say that the term “lawful authority” could be replaced by the term “statutory authority” for greater clarity, however the constitutionality of said statutory authority will, of course, ultimately still be a question of debate.

The further question of the constitutionality of express statutory authorities for disclosure, in light of the Supreme Court of Canada's decision in Spencer, has led the special committee reviewing PIPA in British Columbia to call for a narrowing of its voluntary disclosure provisions under the act.

We want to caution this committee that there are at least two reasons we cannot look to Alberta and British Columbia's privacy legislation relating to the private sector for assurance that proposed expansions of voluntary disclosures found in Bill S-4 are likely to go well.

One, there is a clear concern that those PIPA provisions may not be constitutional in light of Spencer.

Two, however little historical challenge there has been in relation to those provisions thus far, the same will certainly not be the case in relation to the arenas governed by PIPEDA, which obviously include telecommunications.

I have other things that I could say about this, but I think I'll save it for questions.

Thank you very much.

[Dr. Michael Geist]

I'll close by responding to what Mr. Lake noted regarding what happens when witnesses talk about getting it right. I will just provide two things, first to note that the government has painted this legislation as being pro-consumer—obviously part of the digital economy strategy—which makes it clear what the intent of the legislation is. I think it is difficult to say that you're getting that balance right, particularly when the legislation is framed as trying to protect consumers and being pro-consumer, when you have those same pro-consumer groups and even the Privacy Commissioner pointing to problems, such as the voluntary disclosure provision. To me that means that balance isn't getting struck appropriately.

Even more, my reference to getting it right really wasn't in terms of the substance, but rather to say that we should not be cautious about amending the legislation where there is a belief that it can be improved. The question was raised—and my apologies if I got more passionate than I might usually get on this issue, but this is an issue that we have spent many years focusing on—that if we are all in agreement that privacy is important, surely we can give this bill, including potential amendments, the same kind of priority we're providing Bill C-51 with, which is also clearly on a bit of a rocket docket, with perhaps not even the Privacy Commissioner getting to testify on it.

There is an opportunity to do so, if we're going to think about how privacy and security often go hand in hand. If we're prioritizing Bill C-51, we can similarly prioritize Bill S-4 and find a way to get this bill, with some amendments as necessary, done and passed through the Senate and back into the House so that when an election comes, Canadians can look at a piece of legislation and say that it really does reflect the kinds of concerns they have with respect to privacy.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

So the new provision in Bill S-4 really just makes the new legislation consistent with the old. Is that correct?

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Thank you, Mr. Chair.

I found it interesting to listen to all of the testimony first before getting a chance to talk.

Ms. Lawson and Mr. Geist both made similar statements. I wrote down that Ms. Lawson said, “We should be getting it right” and Mr. Geist that “We have to get it right”.

Interestingly, of course, I think that when we have these hearings, “right” means “the way you want it”. Ultimately, there have been other witnesses who have come before committee and said very different things. If the definition of “getting it right” means, for example, agreeing with those who said that consent provisions go too far, which we heard in the previous meeting, I don't imagine you would think it means we're getting it right.

Someone said that our data breach reporting regime is too onerous. If we decided that was the direction to go in, I'm quite certain that neither of you would say that this is “getting it right”. When anyone uses this term, I always hearken back to our hearings on anti-spam and copyright and even UBB. People's definitions of getting it right are very different. As in those cases, we're left to try to find the balance between very different, competing positions, and I think the case with this bill is no different.

Taking a look at three of the areas that have come up, I find it interesting....

Ms. Lawson, I'm going to come to you first and deal with section 20. You mentioned you had some concern with that section, I think around the confidentiality provision written into Bill S-4.

[Annick Papillon, NDP, Québec, QC]

What you are saying is interesting.

Let's come back to Quebec. Quebec legislation relating to the protection of digital privacy sets out exceptions that allow a business to gather or disclose any personal information without the consent of the individual concerned, but these exceptions are very limited and include, for example, situations involving a criminal investigation.

Do you think Bill S-4 could be inspired by what has been done in Quebec?

[Dr. Michael Geist]

Thanks for raising that. It's worth noting that this whole notion of security breach disclosure actually originated out of California, with the idea of creating sort of the perfect world of incentives for companies to do a better job of securing the information, because they don't want to have to go through the cost and potential embarrassment of disclosure. At the same time, it creates incentives or protection for users because they become aware of these disclosures when they happen.

What we've got under Bill S-4 is such a high threshold, and I think Ms. Lawson referenced this as well, that if the standard is only a real risk of significant harm and we don't have big penalties associated with non-disclosure to begin with, at least if you're a larger organization, in many instances, I think it's going to be quite rational, frankly, for an organization not to disclose. They're going to ask, first, what's the risk that anyone will ever find out about this? Second, if they do happen to find out about it and someone shows that there was a real risk of significant harm, then we will face a penalty. But even there, the penalties are relative low.

So what the California law does is to say that we want to ensure that if we're going to err on one side or the other, it's will be to err on the side of trying to mitigate against identify theft, to err on the side of ensuring that there is better security, and by lowering the threshold. We tried to do that a little bit in Bill C-12 and Bill C-29 with the two-step process, so that at least you are made sure that the Privacy Commissioner would be aware of the circumstances where there's a material breach. But in doing away with all of that, I don't think it's just a fear that breaches will occur in Canada. I think these should be expected. And if you asked many Canadians, they would tell you, “Boy, I should have been told about that”. And yet they won't be because companies are going to err rationally, based on the way this law is drafted, on the side of not disclosing it.

[Annick Papillon, NDP, Québec, QC]

Thank you very much, Mr. Chair.

Mr. Geist, thank you for being here today.

During a Senate committee meeting, you gave the example of California, which requires the disclosure of any security breach related to unencrypted personal information when there are reasonable grounds to believe that the information was acquired by an unauthorized person.

Could you give us a concrete example to explain the impact that a similar definition might have on the application of Bill S-4?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

You said there are positive aspects of the measures in Bill S-4.

[Philippa Lawson]

Sorry, I'm not sure what you're referring to. Is it something in Bill S-4?

[Dr. Michael Geist]

No, not a data breach at all. The language used in Bill S-4 is exceptionally broad. It refers to the ability to disclose this information—here, I can try to call it up for you—where it is reasonable for the purposes of investigating a breach of an agreement or a contravention of a law that's either been, has been, or might even be committed, and where it is reasonable to think that if the individual were made aware of that disclosure, it would compromise the investigation.

We're not talking about data breaches here; we're talking about virtually carte blanche voluntary disclosures.

[Dr. Michael Geist]

No. What I'm referring to is an organization that has my information. There may be instances where they are disclosing it either to law enforcement or to private sector organizations.

In the law enforcement context, if it's a warrant, and post the Spencer decision, it's quite clearly now going to be a warrant, or should be a warrant.

In the private sector what this bill does is to say that we can disclose information on a voluntary basis without a court order and without any sort of court oversight.

I'm saying that, over the last number of years under PIPEDA, we've had cases where organizations have said that they want to identify who those subscribers are because they want to sue them, and there's an instance where they are conducting this investigation or have this legal process. The court examines the circumstances around whether there's an appropriate case to order that disclosure and sets limitations on the disclosures that can occur.

What Bill S-4 does is to expand the prospect of that kind of disclosure on a voluntary basis.

[Peggy Nash, NDP, Parkdale—High Park, ON]

I have one other question for you, Ms. Lawson. You talked about the fines today and the fines contained in Bill S-4as the costs of doing business, and you said they're not a serious enough disincentive to any kind of privacy breach.

What do other jurisdictions have? What would be a serious disincentive that would really encourage the private sector to ensure that it is maximizing privacy protection?

[Peggy Nash, NDP, Parkdale—High Park, ON]

Okay, super, thank you.

I do want to reiterate the point, through you, Mr. Chair, that the point of view that is being expressed by the witnesses here today, and the concerns that they're expressing about Bill S-4 were in fact offered to the Senate committee, but those changes that were recommended were not reflected in the bill that we see before us today. I'm assuming that's what we're being advised of here.

I think the witnesses are raising serious concerns and the Privacy Commissioner, himself, raised concerns about the scope of this bill.

Ms. Lawson, I want to start with you and ask you specifically about the subjective model proposed here for companies determining if there's been a mandatory data breach, disclosure on that. Can you advise us of your interpretation of what could happen with what's being offered in Bill S-4, and how you would recommend tightening up that provision?

[Vincent Gogolek]

I have another quick point, which is that, as I mentioned at the beginning of my prepared remarks, the government has decided to refer the bill to this committee before second reading. Presumably, that is because it is open to amendments beyond the statement of principles of the bill. I find your remarks a little puzzling in terms of the difficulty that could ensue if amendments were to be made. Presumably, the government and the government House leader would have been aware of those difficulties when they in fact took the unusual step of breaking the normal process of things, and referring Bill S-4 to this committee before second reading.

[Dr. Michael Geist]

Sure. I'll do that. I'd also like to just note a couple of things. The commissioner did not appear before the Senate committee on Bill S-4. Because of the long delays in getting a commissioner appointed at that time, there was no commissioner, but people from that office were in a position to appear because it had been studied. So the commissioner actually didn't appear on Bill S-4.

In terms of lengthy study, with respect, let's be clear. The committee began a review of this bill in November 2006, and by May of 2007 it released its report.

We got first reading of Bill C-29 in May 2010. A second reading took until October. There were never any hearings held on Bill C-29.

The next bill that was introduced was Bill C-12, which was the second attempt at this bill. It sat at second reading for two years without moving forward. There were no committee hearings held on it.

We finally now have Bill S-4, on which there were two sets of hearings. Four days were allocated to this piece of legislation within the Senate: one day for the minister to appear; another day for clause-by-clause; two days for hearings. So if we're going to talk to witnesses about not having appeared, frankly, there were very, very few witnesses who had the opportunity to appear at all. This is, with all respect, not a well-studied bill. It is a bill that has now come through three times, and in most instances there has been no study whatsoever. When the Senate had the chance to hear on this bill, there was not even a privacy commissioner in place to deal with it, due to the long delay in finding a new commissioner to replace Commissioner Stoddart and later acting commissioner Chantal Bernier.

With respect to the commissioner's support, yes, I too can cherry-pick particular comments from the Privacy Commissioner about where the commissioner supports the legislation, but I can also note that the commissioner's office has been consistent in saying that it finds it problematic with respect to voluntary disclosure, and yet that hasn't changed, and in identifying a number of other improvements.

So the question is this. Is this a well-studied bill that we ought to get on with? With respect, it is both not well studied and ought to be fixed. Canadians deserve better.

[Mark Warawa, Conservative, Langley, BC]

Okay.

Chair, I think it would have been very helpful if these points had been made at both the Senate and the House.

My question relates to a presentation made by the commissioner. The commissioner made a presentation not quite a year ago, in June of last year, before the Senate committee as they were dealing with Bill S-4, and then appeared before this committee on February 17.

I just want to read the summary of the commissioner. The commissioner does have new tools and greater flexibility to enforce PIPEDA. The commissioner said:

Overall, the introduction of Bill S-4 is a positive development for privacy protection in Canada. PIPEDA was written in the 20th century. It is more than a decade old. From a privacy perspective, the world has changed dramatically during this relatively short time. Passing Bill S-4 with a few adjustments will strengthen PIPEDA and help the Office of the Privacy Commissioner better protect Canadians while addressing the emerging privacy issues of the 21st century.

Also unable to be with us today, Chair, is the Insurance Bureau of Canada. They provided a submission to the Senate when this was dealt with last year and they've communicated their support for aspects of the bill, particularly the fraud prevention measures.

Generally, the committee has heard support for this, and it's important that we provide the protection Canadians want. Bill S-4 does that.

Do any of the witnesses here today have a critique of the commissioner's perspective in supporting Bill S-4 going ahead?

[Mark Warawa, Conservative, Langley, BC]

Thank you, Chair.

Thank you to the witnesses here today.

I think each of the witnesses is aware that there have been hearings back to 2006, which I think Mr. Geist referred to.

PIPEDA was written in the 20th century. It's over a decade old and it needs to be improved. This is what Bill S-4 attempts to do.

Also, it is almost impossible to get unanimous support for any piece of legislation, so I think there has been a lot of energy that's gone into improving PIPEDA. Canadians want companies to tell them if their personal information has been lost or stolen and if they've been put at risk. I think that consent needs to be appropriate, particularly for target groups like children.

Dr. Geist, you've been involved with providing input to the Senate. You were involved in the hearings back in 2006.

My question is for Mr. Gogolek. When the Senate dealt with this at committee a year ago—not quite a year ago, but when the hearings at the committee in the Senate were beginning on Bill S-4, did you appear as a witness? As you're aware, any legislative changes have to be supported in both Houses, and Bill S-4 began in the Senate and is now in the House of Commons. Were you a witness when this was dealt with at the Senate?

[Judy Sgro, Liberal, York West, ON]

Thank you.

That's the area that I am most concerned about. Every time we pick up our BlackBerry or whatever gadgets we have, I agree that we don't read it. I would suggest that very few people read any of that. It's just an automatic check. It's a nuisance, and we just agree to it—until we find out that we have no protection, or very little protection. I think that's what we are trying to do here: to look at how to protect the consumer.

I attended a conference on cybersecurity yesterday. Certainly the issues that were raised there about security, whether you're talking about the Internet and so on, somehow make Bill S-4 look like it's still nowhere near what it should be, or the kind of legislation we need to be putting forward to better protect Canadians. I think it's unrealistic, frankly, to think that with this legislation companies are going to be reporting all of these breaches and so on. I think they'll ignore it. I think a $100,000 penalty is insufficient for a significant breach, based on the kinds of things we're learning through this process.

Certainly, Dr. Geist, your comments about transparency and disclosure would go toward improving it, as far as the real risk that consumers are facing is concerned, before they get into things like identity theft and violation of their basic rights. I don't want all my information shared with every Tom, Dick, and Harry who wants it. If we are going along with Bill S-4—and, from my party's perspective, I'm not sure that we are, but at least we're trying to make some improvements—what else would you suggest we need to put in here to make it stronger and more enforceable? I would ask that of all three, given my timelines here.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much. I have one last question for you.

We are studying this bill before second reading, which is a rather unique situation. For me, this means that we have an opportunity to really improve the bill and make important amendments in order to properly protect the privacy of Canadians. We also have the opportunity to go beyond Bill S-4. We can adequately amend PIPEDA to properly protect Canadians.

Do you think that, in the wake of the Spencer decision, we should amend the provisions of PIPEDA that relate to the disclosure of information without consent? Should we go that far? Do you think it's necessary to do this? Should we take this opportunity?

My question is for all of the witnesses.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Mr. Gogolek, I would like go back to the Personal Information Protection and Electronic Documents Act, or PIPEDA.

You were actively involved in assessing this legislation following the Spencer decision. I read with great interest the report that was produced and that recommends amending the legislation to improve the framework for disclosing information without consent and without warrant.

Obviously, we do not want to establish 10 different privacy protection regimes in Canada. We want to ensure in some way that it is comprehensive.

If we are in the process of amending an act that Bill S-4 is supposed to resemble, should we not be proactive and amend the bill so that it corresponds to the new act?

[Vincent Gogolek]

Given the complexity of the vocabulary used, I will answer in English if I may.

I agree with what Professor Geist has just said. The federal Privacy Commissioner has noted that there are difficulties with Bill S-4 as a result of the Spencer decision. Our commissioner in British Columbia has as well. Commissioner Denham has been calling for tightening of our legislation “without consent to cases where the disclosure is “necessary” for purposes related to an investigation or proceeding.” At the same time that the current version of Bill S-4 is taking one approach, one of the substantially similar provinces—one of the committees—is heading in the opposite direction as a result of their understanding and interpretation of the Spencer decision. As Professor Geist said, the drafters of Bill S-4 didn't have the advantage of Spencer. We do today. We know what the Supreme Court of Canada said about this. I think we have to take this into account.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much, Mr. Chair.

I would like to thank all of our witnesses for being here today. You all have some very interesting points of view.

My first question relates to the Spencer decision.

Mr. Geist, you have already testified before the Senate, but the decision had not yet been made. So I would like to hear your opinion on the decision and its possible repercussions on Bill S-4.

When the minister appeared, he seemed to think that no changes to Bill S-4 and the PIPEDA were required. I would appreciate hearing the other witnesses comments on this, if they have any.

[Philippa Lawson]

Thank you very much.

Good morning, committee members. Thank you for the opportunity to address you on the matter of Bill S-4, which proposes amendments to PIPEDA.

My involvement with this legislation goes back to its genesis with the CSA model privacy code and the subsequent initiatives to legislate voluntary standards. As a lawyer with the Public Interest Advocacy Centre at the time, I was a public interest representative on the committee that drafted the code. I later advocated for legislation that eventually took the form of PIPEDA.

I have been closely involved with PIPEDA ever since, first in my role as a consumer advocate with PIAC and later as director of CIPPIC, both of whom I understand you have already heard from. In particular, I have conducted studies of private sector compliance with PIPEDA. I have lodged a number of PIPEDA complaints with the Privacy Commissioner. I have taken the Privacy Commissioner to court in order to establish that she had jurisdiction to enforce PIPEDA against foreign corporations acting in Canada. I published a study of security breach notification laws in 2007. I've been urging the government to adopt mandatory security breach notification laws since 2003.

Today I am speaking on my own behalf as a lawyer and privacy advocate. The last formal submissions I made on PIPEDA reform were in 2008 in my role as director of CIPPIC. Those submissions focused on three issues: security breach notification, protection of minors, and compliance and enforcement. The analysis and proposals made in those comments remain apt today, and I would be happy to provide copies of that submission to anyone who is interested.

I'm happy to see that the government has seen fit to address all three of these issues in Bill S-4, but I am disappointed that the measures in each case fall far short of what is needed. I will address each of these three topics briefly, but before doing so I would like to address an elephant in the room. That elephant is consent.

There is a pretense that companies are obtaining informed consent from customers to the collection, use, and sharing of their personal data. But anyone who takes the time to study what is actually going on will quickly see that this is, to a large extent, a fiction and that meaningful consent is rarely obtained from consumers.

Negative option consent is commonly used but rarely brought to the attention of customers. Consent is in fact often assumed simply by virtue of use of the service. Changes to privacy policies are simply posted on the company website and customers are expected to inform themselves. No one really expects individuals to read through lengthy, complex terms of service for every transaction. People simply don't have the time. If they do take the time to read the terms, they may find that they are notionally consenting to have their personal data used for purposes such as—and I'm quoting here from privacy policies that I've looked at—research, marketing, product development, and business purposes. In further violation of PIPEDA, many companies are refusing to deal with customers who won't agree to unnecessary uses of their personal data, such as marketing.

A reality check is needed on what is happening in the marketplace with so-called customer consent. In the meantime, proposed section 6.1 is a helpful qualification on what the law already requires. It may have some positive effect on what is, in my respectful submission, a widespread disgrace.

However, the current wording of proposed section 6.1 could actually have a perverse effect on the protection of children or seniors. If you read the clause, you will see that it fails to protect vulnerable populations to whom an organization's activities are not directed. All that a company needs to do to exploit children is to direct its activities to adults and then turn a blind eye to the fact that children are signing up. A simple fix is to revert to the earlier wording of this clause found in Bill C-12. However, if if the aim is to protect children, a much more effective approach is simply to prohibit certain uses of personal data about children.

I have a few words on breach notification. This is long overdue, and it will certainly be an improvement on the current situation. But are the proposed rules going to be effective? Breach notification is about more than notifying individuals. An equally important goal is to create incentives for organizations to put in place strong security safeguards.

In order to create such incentives, there needs to be a real risk of significant financial harm to a corporation from failing to put in place adequate security measures. This is the test you should be applying to your assessment of the proposed breach notification regime: is there a real risk of significant financial harm to corporations from non-compliance?

I am not convinced there is. Fines apply only to failure to report or failure to keep records and require cumbersome proceedings and proof of intent. Civil lawsuits are too costly to make sense in most cases, and the Privacy Commissioner may be dissuaded from using publicity for this purpose as a result of subsection 20(1.1), which prohibits disclosure of breach notification reports. I do not understand that section.

Until there are real financial incentives for corporations to take appropriate measures to prevent breaches from happening in the first place, and to otherwise comply with privacy laws, non-compliance with PIPEDA will continue to be a cost of doing business in Canada.

I'd like to finish with a few comments on private investigations. I am very concerned that, if the proposed changes to the current investigative body regime exception go through, this bill will actually set back privacy protection in Canada.

I will not repeat the able submissions of my colleague Dr. Geist on this subject, but let me just point out that in the new world of cheap data storage and powerful data analytics, the only limits on how far companies will go in their efforts to detect fraud, criticism, or contractual breaches will be what you put in this law. With today’s technology, it’s less costly to gather more data and to apply analytical tools to a large database than it is to restrict the intake of data to that needed in the first place.

In this context, insurance companies and other companies will, no doubt, argue that it's reasonable for them to conduct what amounts to broad and deep surveillance of their customers in order to detect fraud.

Paragraph 7(3)(d.2) would allow just that. It requires no formal investigation. The disclosure just needs to be reasonable, not even necessary as in the previous formulation in Bill C-12. This provision would open the door to routine sharing of personal data among organizations based on nothing more than the always present risk of fraud. Moreover, there would be no transparency or accountability requirements. It would be a major setback for consumer privacy.

I understand that this amendment was based on the Alberta model, but I looked at the Alberta model, and subsection 20(n) of the Alberta statute is not as permissive as this. It actually limits sharing to certain kinds of organizations.

I urge you to remove these clauses from the bill and stick with the current investigative body regime. I also urge you to adopt the transparency measures that my colleague Dr. Geist recommended.

Thank you very much.

[Dr. Michael Geist, Canada Research Chair, Internet and E-commerce Law, University of Ottawa, As an Individual]

Thank you, Mr. Chair.

Good morning. My name is Michael Geist. I'm a law professor at the University of Ottawa, where I hold the Canada research chair in Internet and e-commerce law. I've appeared before this committee on a number of occasions on digital policy issues, including privacy, and I appear today, as always, in a personal capacity representing only my own views.

Actually I previously appeared before the Senate committee that was studying Bill S-4 and my remarks then focused on three broad issues.

First, I offered my support for several important provisions in the bill, particularly the additional clarification on the standard of consent, the extension of the deadline to take cases to the Federal Court, and the expansion of the powers of the Privacy Commissioner to publicly disclose information related to findings or other matters. Second, I identified issues that I think need amendment or improvement: the security breach disclosure rules, particularly the abandonment of a two-step disclosure process that was found in some earlier bills; the compliance agreements provisions, which I think could be strengthened with penalties or order-making power; and the expansion of voluntary disclosure of personal information between private sector organizations. Third, I talked about some missing provisions, namely, what I think is the need for mandatory transparency reporting.

My time this morning is limited, so I'm going to delve deeper into just two issues, the voluntary disclosure provision and transparency reporting.

On voluntary disclosure, as you know, Bill S-4 expands the possibility of personal information disclosure without consent or court oversight to anyone, not just law enforcement. As you know, the bill features a provision granting organizations the right to voluntarily disclose personal information without the knowledge or consent of the affected individual and without a court order to other non-law enforcement organizations provided they are investigating a breach of an agreement or legal violation, or even the prospect of a future violation.

This broadly worded exception will allow companies to disclose personal information to other companies or organizations without court approval. I believe this runs counter to the court decisions that we've seen from the Federal Court, which have sought to establish clear limits and oversight over such disclosures as well as the spirit of the Supreme Court of Canada's Spencer decision, which ruled that Canadians have a reasonable expectation of privacy with such information. In fact, if we examine the leading cases involving disclosure of customer information in private litigation—not to law enforcement but in private litigation—such as in Warman v. Fournier, BMG v. Doe, Voltage v. Doe—virtually all emphasized the need for safeguards before customer information is disclosed, even as part of an investigation.

A House of Commons committee did recommend a similar reform in 2006, but that recommendation was rejected at the time, both by the Conservative government and the Privacy Commissioner of Canada.

I recognize that some have suggested that both Alberta and B.C. have similar provisions and that no harm has resulted from their approach. I'm not so sure. I don't think anyone can reasonably conclude that the provincial approach has not resulted in privacy risks or harms. It's important to bear in mind that the disclosure itself is not necessarily revealed to the affected individual. Indeed, the point is often to disclose without knowledge or consent, meaning the affected individual will not know that their personal information has been disclosed. Asking for evidence of harm when the harmful conduct is kept secret from those who are affected creates an impossible evidentiary burden. In fact, even if you believe that the disclosures might come to light through court processes should it reach that point, and we know that oftentimes the disclosures won't ever reach the point of a court case, provincial privacy law such as we find in Alberta and B.C. rarely involves having these kinds of cases come to light. It's no coincidence that the leading cases involving personal information involve PIPEDA, because those cases typically involved telecom companies, Internet service providers, websites, and banks, all largely governed through PIPEDA.

In other words, the existence of this kind of provision at the provincial level actually tells us very little about how it will be used under PIPEDA. The reform here, I think, is clear. There is no compelling need for a change. The current system has been in place for many years and there are dozens of organizations that are covered by the investigative bodies exception. It may have been a bit of a hassle 10 years ago, but now the reform makes little sense. Further, if there are specific industries that can point to concerns, I think those can be addressed through a narrow amendment, but the broad provision that we have here opening the door to massive expansion of non-notified voluntary disclosure without any of the kinds of limitations that we typically find even the courts asking for should be removed.

Second is the need for transparency reporting. The lack of transparency in reporting requirements associated with personal information disclosures, I think, is a glaring omission from the bill. The revelations last year of over a million requests and over 750,000 disclosures of personal information in a single year, the majority of which happened without court oversight or a warrant, point to, I think, an enormously troubling weakness in Canada's privacy laws.

More recently, the Privacy Commissioner of Canada tried to conduct an audit of RCMP requests for subscriber information and was largely forced to abandon the audit when the data there were found to be inaccurate and incomplete.

Now, there are some companies, such as Rodgers and Telus, that have begun to issue transparency reports, but there are others, most notably Bell, that have not. Most Canadians have simply no awareness that this is taking place. This deficiency can be addressed, I think, through two reforms.

First, the law should require organizations to publicly report on the number of disclosures they make without knowledge or consent and without judicial warrants. This information should be disclosed in aggregate on a quarterly basis—every 90 days. I'm not talking about disclosing it to each individual immediately; we're talking about its being on an aggregate basis and a quarterly basis.

Second, those organizations should be at some point in time required to notify affected individuals within a reasonable time. Leave aside the necessity to keep it secret, if necessary as part of an investigation; once it is concluded or a reasonable amount of time has passed, either get a court order to continue the secrecy or disclose the disclosure to the affected individual.

The adoption of those kinds of provisions—transparency reporting and that disclosure—would, I think, be an important step forward in providing Canadians with greater transparency about the use and disclosure of their personal information.

I welcome your questions.

[The Chair, Conservative, David Sweet]

Good morning, ladies and gentlemen. Bonjour à tous.

Welcome to the 36th meeting of the Standing Committee on Industry, Science and Technology. We are studying Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act.

We have before us today, from the BC Freedom of Information and Privacy Association, Vincent Gogolek, the executive director.

We were going to have the Insurance Bureau of Canada here, but they're stuck on the tarmac in Toronto in a plane that was not able to go. They're trying to get on another plane, but of course they're not going to be able to make it to the meeting. We have already rescheduled them by phone for another meeting.

We also have before us Michael Geist, Canada research chair in Internet and e-commerce law at the University of Ottawa. He is testifying as an individual.

By teleconference we have Philippa Lawson, barrister and solicitor. She's coming to us from Whitehorse in Yukon.

Can you hear us okay, Ms. Lawson?

[Suzanne Morin]

I did hear the testimony earlier this week where that came up. Maybe I can give you a really quick example of it.

Take a call centre context, where someone calls in and says, “I received the bill of my neighbour at my home.” What would happen in that context is that the call centre representative would say, “Oh, that's horrible. We'll send you an envelope; can you please send the bill back to us?” Then the call centre representative would reach out to the other customer and say, “We're very sorry, but your neighbour received your bill. We apologize.” They would then make amends.

That situation is technically a breach of security safeguards, because the wrong bill went to the wrong customer. It's a one-off. It's not insignificant to those two customers, but it's insignificant in the grand scheme of when you think about breach notifications. The way Bill S-4 is worded today, it would require us—by “us” I mean any industry or organization subject to PIPEDA—to develop a system to log that somehow. It's taken care of. It's managed. It's handled. But it would have to be logged somehow, through a different system. Otherwise the organization is subject to new offence provisions, which are very serious. The breach notification offences are quite serious in the record-keeping—

[Judy Sgro, Liberal, York West, ON]

Thank you very much, Mr. Chair.

Mr. Lawford, you're not happy with where Bill S-4 is.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

My second question is for Mr. Israel and Mr. Lawford.

In terms of the compliance agreements, we know that one of the objectives of the bill is to ensure that organizations are really taking PIPEDA seriously, which is unfortunately not always the case right now.

Do you think the compliance agreements proposed in Bill S-4 are sufficient to really encourage organizations to comply with Canadian law?

[Suzanne Morin]

Clearly, our position is different. We don't think amendments need to be proposed for PIPEDA or Bill S-4. The Supreme Court did its homework, which was to interpret one provision in an existing piece of legislation. We therefore don't think amendments need to be made.

[Suzanne Morin]

From the CBA's perspective, we totally understand the movement from investigative bodies to the regime that's proposed in Bill S-4, which is similar to B.C. and Alberta, as you just stated. Because of the concern we had been hearing in the media and others, when you read the words on the page, we thought that maybe there's an opportunity just to rein it in a little bit, so we proposed very targeted amendments to more reflect what actually happens in practice today under investigative bodies. It was more in keeping with the environment of the time, I think, that those recommendations are being proposed.

[Suzanne Morin]

Actually, in a way I would echo Mr. Lawford. In particular, as regards breaches, there has been extensive voluntary compliance because industry does actually see their security safeguard obligations requiring notification to individuals. Maybe the only little piece that Bill S-4 brings is the reporting to the OPC, but that's actually happening on a voluntary basis because of the excellent guidelines that the OPC has issued.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Because our time is so tight here, I'm just going to go to all three of you, in a sense, and ask this question. Are we better off with Bill S-4 as is, than prior to Bill S-4, than we are currently, in a sense? If we pass Bill S-4 as it is, are we better off with our privacy legislation than we were before?

[John Lawford, Executive Director and General Counsel, Public Interest Advocacy Centre]

Thank you very much, Mr. Chair.

Honourable members, my name is John Lawford. I'm the executive director and general counsel of the Public Interest Advocacy Centre, a national non-profit, federally incorporated organization founded in 1976 that provides legal and research services on behalf of consumer interests, and in particular, vulnerable consumer interests.

Due to the time I'm going to be speaking today solely to the breach notification amendments. However, I'll be happy to take questions on other aspects of the bill.

PIAC believes that the goal of an effective data breach notification law is to actually notify individuals of the loss, unauthorized access, or theft of their personal information from an organization whenever it is possible for the individual to take steps to avoid financial, reputational, or other harms, or to minimize these impacts. In our view this goal can be accomplished in a manner that also removes conflicts of interest in reporting breaches; reduces compliance cost and risk for business, in particular small business; generates data for better policy outcomes; engages, improves, and leverages the expertise of the Office of the Privacy Commissioner, OPC, in dealing with breaches; and encourages business and consumers to make investments in data security.

Unfortunately, Bill S-4, as written, will very likely result in fewer reported breaches than even now and operate in an opposite manner. Namely, it will create a culture of fear, recrimination, and non-reporting. Bill S-4, incentivizes not reporting data breaches by leaving the determination of whether a breach creates a real risk of significant harm to an individual totally in the hands of the organization that suffers the breach. This obvious conflict of interest is fatal to the purpose of the bill as there is no advantage to a company to report and every advantage to hide a data breach.

The conflict of interest in having a company assess whether an individual faces a real risk of significant harm from a data breach is one that will be settled in close cases and some more egregious ones by the company concluding there is no such risk. Such an assessment avoids the cost, reputational damage, and inconvenience faced by the company. It also avoids putting the company on the radar of the OPC for an audit or an investigation.

While it's true the company does face prosecution under the amended section 28 of PIPEDA and a possible fine up to $100,000, perhaps even per record, that offence is premised on not reporting a breach knowingly. Any organization that sets up even the most basic process to come to a conclusion that a breach was not a real risk of significant harm would have a very strong defence. This flaw is exacerbated by the bill's requirement to report all breaches regarding a real risk of significant harm simultaneously and relatively instantly to the OPC, whose role is purely observational, to affected individuals and to unspecified third parties who may be able to help. Which individuals to notify will be determined solely by the company involved, which will be dealing with the chaos of several reporting requirements that frankly make little sense as structured. The incentive again will be to keep the reporting to individuals to as few in number as possible. Contrast this with our vision of how Bill S-4 could work.

Step one, replace the initial reporting to all parties on the real risk of serious harm test for the requirement to immediately report material security breaches involving personal information to the OPC only. In Bill C-12 of the previous parliament, in that version, proposed section 10.1, did this very well with one exception. We would recommend removal of the systemic problem assessment, which the bill required and which also led to the disincenting of reporting.

Step two, leave the decision of whether to order—and yes, I said order—a company to report a data breach to individuals to the OPC. The company would have no say in the matter. The OPC would be an impartial third party arbiter of whether a breach was a real risk of significant harm to affected individuals. The OPC would gain experience, expertise, and authority in assessing breaches. The OPC decisions would be made public, meaning Canadians would finally know which companies had breaches, because this is presently not known for all breaches under the voluntary breach notifications referred to and the private conversations that we know the Office of the Privacy Commissioner has with companies.

Finally, the gathering of security failings generates data that could lead to better policy outcomes based on encouraging companies to invest in improved data security.

This approach would also benefit business, especially small business. With the OPC making the individual notification call, the business would be relieved of the compliance costs in hiring consultants to manage its data breach response, as the OPC would specify when, how, and how much notification was required. It would virtually eliminate the risk of civil liability for data breaches. The OPC could provide extensive breach notification guidance and materials to ease the reporting process for business in dealing with the stress of a breach.

This committee could save time and effort in designing step two by essentially copying the relevant section of Alberta's Personal Information Protection Act, namely section 37.1 of that act.

Finally, a rewrite of Bill S-4, as suggested, should encourage both business and consumers to take personal information security and the response to it more seriously. For business, a step-one requirement to report security breaches to the OPC would drive investments to improve systems in order to avoid having to report breaches. For consumers, a step-two notification could be treated as authoritative, serious, and OPC-approved assurance of impartiality, and spur consumers to take action to appropriately deal with breach notification and, finally, to reflect their judgment of the information-handling practices of the business to those businesses.

Thank you very much. I await your questions.

[Tamir Israel, Staff Lawyer, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic]

Thank you, Mr. Chair, and committee members.

My name is Tamir Israel, and I'm a staff lawyer with CIPPIC, the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic, at the University of Ottawa. CIPPIC works to advance the public interest in policy debates that arise at the intersection of law and technology. We're very grateful for this opportunity to provide our input into Bill S-4, the digital privacy act, which will make some important changes to PIPEDA, Canada's federal commercial sector privacy law.

Concern over privacy and lack of trust in organization practices remain an ongoing concern for a number of Canadians. A recent survey commissioned by the Privacy Commissioner found, for example, that over 75% of Canadians have avoided the use of a mobile application because of the information requested, and close to 60% have turned off location tracking functionality on their mobile devices out of concern that others will access the information. These types of statistics are telling, and they show that Canadians remain concerned, and are acting on their concerns, when engaging with digital content.

Even as concerns grow, avoiding privacy-invasive practices becomes increasingly difficult. Every device, from our mobile phone to our car to our television at home, is now a cause of concern for those wishing to maintain a sphere of privacy. The task of keeping up with the multitude of settings and privacy policies on all of these is time-consuming, and increasingly out of reach for many segments of the digital population.

Against this backdrop, Bill S-4 introduces some much-needed improvements to PIPEDA, while at the same time raising some concerns. We're particularly pleased to see the inclusion of compliance agreements and an extended appeal period, as those take some important initial steps towards resolving long-standing problems with PIPEDA's complaint mechanism. We hope that additional changes will be considered at the next statutory review of the bill, which is coming up in the next couple of years. We particularly point to long-standing problems with the lack of proactive compliance incentives as something that we think still needs to be addressed.

With respect to Bill S-4, I'd like to address three parts of the bill very briefly: the new consent requirement, breach notification regime, and some of the information sharing exceptions.

Clause 5 of Bill S-4 will enact proposed section 6.1 of PIPEDA, which seeks to strengthen the consent obligations so that individuals will be aware of the nature, purpose, and consequences of the activities that an organization seeks to carry out with their data. In general, this will mean that where an organization targets or becomes aware that it's dealing with vulnerable individuals such as youths, additional steps to ensure that its privacy practices are understood will have to be taken.

If dealing with young children, it may not be possible at all to make the young children themselves aware of the consequences of their actions, and verifiable parental consent might be required. This is in line with industry practices for minor-specific sites that interact with very young children. There are already legal obligations in some jurisdictions, such as in the United States, under COPPA.

The consent provision will also have a positive impact in other contexts. Strengthening the obligation of organizations to ensure that customers are aware of the nature and consequences of data practices will help individuals make more informed privacy choices in general.

We're a little concerned that recent changes to the bill over its predecessor may shift the focus of the provision to individuals whom the activities are directed at, as opposed to specific individuals whom the organization is dealing with. We're concerned in particular that one common practice would, for example, put in a privacy policy that no children under 13 are permitted on the service; then, when they become aware that large numbers of children under 13 are using the service, the way the consent is phrased might be taken to preclude the additional obligations that should normally apply in that context.

With respect to Bill S-4's breach notification obligation, we're very grateful to see this notification obligation coming into force. It's much delayed and needed. The breach notification obligations have become a standard for 47 states throughout the U.S., and the White House recently announced a federal breach notification bill.

The breach notification regime that Bill S-4 would enact requires that individuals and the Privacy Commissioner be notified where a breach of security safeguards creates a real risk of significant harm. As are my colleagues from the Canadian Bar Association, we're concerned that the standard for notifying the Privacy Commissioner is too high. Additionally our experience has been that it's very useful to have notification directly to the Privacy Commissioner of a majority of breaches for tracking purposes and to generally improve incentives to adopt rigorous technical safeguards.

Even a breach of safeguards that does not lead to the risk of significant harm can be indicative of a general laxity in technical safeguards that should be addressed. We think it's good to have a notification requirement to the Privacy Commissioner that's more comprehensive even where there's no real risk of significant harm to specific individuals.

We're very grateful to see a penalty regime for instances where the breach notification obligations are knowingly ignored. We think that at least over time it would be good to improve this into a more generalized administrative monetary penalty regime. The fines currently in PIPEDA are designed as penalties for very overt offences. An administered monetary penalty regime would be more fitting as it would be focused on securing compliance. That gives businesses more leeway where innocent mistakes are made on the one hand and it may have more teeth where repeat offences are made or where there's a need to secure compliance. I think that would help improve the rigour of this bill, this breach notification regime.

I'll speak briefly to the information sharing elements of the bill. We find a number of these problematic. They raise some potential issues particularly on the private sector side, but we also have some concerns on the public sector side as well. Subclause 6(10) of Bill S-4 replaces the current investigative bodies exception, which permits an exhaustive list of non-governmental regulatory bodies such as the Law Society of Upper Canada to receive information relating to an investigation.

The issue that's intended to be addressed is the difficulties inherent in getting listed as an investigative body. New bodies emerge on occasion, the names of existing bodies change, and each time this happens regulations need to be passed. It's an onerous process. We support addressing that issue.

We're a little concerned that the remedy adopted to address that exception may open the door to unwanted information sharing, particularly in the context of intended lawsuits or where a private company wants to investigate the customer of another company. The provisions adopted in Bill S-4 are an improvement over those in Bill C-12 because they limit the situations in which a company can disclose their customers' information to another company to situations where it can reasonably be expected that if the customer were aware it would compromise the investigation or the impending lawsuit.

However, we're still concerned that this will open the door to customer sharing in a context where the courts have said very specifically that there's a specific process for when you're looking to go after an individual with a potential lawsuit. What you should be doing is filing a statement of claim and going through third party discovery processes, which have built-in safeguards for privacy.

We're concerned that this exception will at the very least give some companies the impression that they will be able to disclose their customers' information. We've had some fairly prominent examples of this in Canada. Some ISPs have been asked, in court so far...because the Federal Court of Appeal has said to date that you cannot disclose your company's information to a potential plaintiff without a court order.

Some of these have gone through the court system and they have even been problematic there. Copyright trolls have asked for the identities of thousands of ISP customers. We've seen other examples where this type of thing could be problematic, so we would appreciate clarification that this exception is not intended to facilitate the types of requests that are to facilitate lawsuits in essence.

We also have some brief concerns relating to proposed section 10.2, which is part of the breach notification regime, which obligates companies who are already disclosing to an individual and to the Privacy Commissioner that a breach of security safeguards has occurred. These companies will also be obligated to notify an open-ended list of companies and government bodies that they believe might assist in the reduction of harm.

In principle, this exception is logical. However, we would like to see some more safeguards in this exception.

Part of the issue is that many agencies that deal with security, particularly in the cyber context, are the same agencies that also conduct investigations on a range of other issues, and security can implicate the private data of several thousand if not tens of thousands of individuals. We're concerned that more information than is necessary may get passed along in these exchanges when they occur.

[Suzanne Morin, Executive Member, National Privacy and Access Law Section, Canadian Bar Association]

Thank you, Jean.

I will limit my opening remarks to just two areas regarding the breach notification regime. The first one is thresholds for reporting to the Privacy Commissioner, and then the second area will be record-keeping.

As you may know, unlike its predecessor, Bill C-12, clause 10 of Bill S-4 sets out a single test or threshold for both notifying individuals of a breach and reporting to the Privacy Commissioner. In effect, every breach that is notifiable to an individual will now also be reportable to the OPC, requiring businesses to change their current practices. The objective of reporting to the commissioner in essence is to track the volume and nature of breaches to see if there are any trends and to allow the commissioner to work with organizations, small and medium-sized organizations, who may need assistance.

This objective is very different—very different—from the objective of notifying individuals so that they can mitigate harm that may result from the breach. This distinction is actually very well understood both by industry and by the Privacy Commissioner's office. In fact, industry players have been following for years the guidelines “Key Steps in Responding to Privacy Breaches”, which were jointly issued by the Privacy Commissioner with their B.C. and Alberta counterparts. These guidelines have existed for several years and have been followed by the industry very successfully. While the threshold for notifying individuals should be based on the existence of a real risk of significant harm, which is what Bill S-4 does today, reporting to the OPC should be premised on the existence of a material breach.

Second, regarding record-keeping, we are of the view that the mandatory record-keeping for all breaches of security safeguards regardless of significance is unworkable, extremely impractical, and places too great a burden on all organizations regardless of size or industry, with no commensurate benefit for the protection of Canadians. In fact, this is really our overarching concern when these new record-keeping obligations are considered in light of the new proposed offences which, in our view, strip away the delicate balance in PIPEDA. In no event should a deficiency in logging be an offence.

As currently drafted, and due to the lack of a specific materiality threshold for reporting breaches to the OPC that I just referred to, every single breach of security safeguards, once again regardless of how trivial, must be diligently logged because it will be an offence to do so improperly or imperfectly.

In closing, we should be focusing on those breaches of security safeguards that might have the most impact on Canadians.

Once again, on behalf of my colleague and me, thank you for the opportunity to meet with you here with today, and we welcome your questions.

[Jean Nelson]

Thank you very much, committee members. My name is Jean Nelson, and I'm a member of the executive of the Canadian Bar Association's national privacy and access law section. I'm also a member of the Canadian Corporate Counsel Association's advocacy committee.

With me is Suzanne Morin, who is also a member of the national privacy section's executive.

Thank you very much for taking the time to hear from us today, especially on a very busy day. The CBA, as you might know, is a professional association of 36,000 lawyers. We represent a diversity of organizations, not-for-profits, members of the private bar, and corporate counsel. Our mandate includes upholding the rule of law in the administration of justice. It's from that perspective that we come to you today.

We want to speak in support of the objectives of Bill S-4, but we wish to also make some recommendations. Our recommendations are offered in the spirit of ensuring greater clarity for Canadians, Canadian businesses, and Canadian organizations. I am conscious of the time, so I will highlight two aspects of our written brief, which you should have before you. I will highlight disclosure without consent, and my colleague Ms. Morin will highlight breach notification. We'd be pleased to answer questions about any aspect of our brief.

First I will speak to disclosure without consent. We believe, in a nutshell, that this provision should be subject to further analysis in order to consider narrowing its scope. We are concerned that, as drafted, it's unnecessarily broad and will permit disclosure without consent in an inappropriately broad range of circumstances.

These new sections appear connected to the removal of the concept of investigative bodies from PIPEDA. You might recall that under that investigative body scheme, the Governor in Council could approve by regulation specific bodies or categories of bodies to which organizations could disclose personal information. These proposed new sections are consistent with CBA's position on this issue as expressed earlier, when it urged the government to consider the models used in Alberta and British Columbia. However, in our perspective, it doesn't quite hit the mark. We believe it requires finesse, as we said in our written brief. We would be pleased to work with Industry Canada and other stakeholders to achieve the appropriate balance.

We understand the need for the proposed additions, as major industries in Canada, such as banks, financial services, and other private sector organizations, need to share information to detect, suppress, and investigate fraud. We are of the view, however, that this provision should be more closely tailored to its actual purpose to prevent abuse of its broad wording.

Mr. Chair and committee members, that concludes my remarks. With your permission, I'd like to now invite Ms. Morin to amplify the CBA's perspective on breach notification in Bill S-4.

[Peggy Nash, NDP, Parkdale—High Park, ON]

Do you mind if I clarify my question? What is the problem that this change in Bill S-4 is trying to fix?

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you, Mr. Chair.

In terms of the issue that has been of concern to this committee about warrantless disclosures and the concern, for example, that the recent Supreme Court decision may require amendments to Bill S-4 as it currently stands, how has business been handling this concept of warrantless disclosure and the sharing of information without the knowledge of the individuals up until now? I presume it hasn't specifically been permitted. Has that been a problem? In other words, has it been business saying the issue of not requiring consent is a problem we need to address?

[Scott Smith]

I can't say that it will help with the enforcement of PIPEDA. There is a high degree of compliance with PIPEDA as it stands right now. I don't see that changing with Bill S-4 in our understanding of the offence provisions that are included in Bill S-4. They are intended to deal with the most egregious infractions where there is a deliberate contravention of the act.

[Mark Warawa, Conservative, Langley, BC]

Good. I appreciate that clarification.

The commissioner said PIPEDA is written in a general language to allow flexibility so if there was contradiction, a breach, and inadequate reporting, if there's a complaint lodged, then it would go through the Privacy Commissioner. He or she would look at it, and at this point he has 45 days to take an action. S-4 is suggesting that change to a year.

Would you agree with that proposed change?

[Scott Smith]

Yes. We certainly don't oppose S-4. As I said in my opening statement, we're suggesting there are a few targeted changes that could be beneficial, but by and large we certainly support S-4.

[Mark Warawa, Conservative, Langley, BC]

The reason I ask is I'm a member of a very active chamber in Langley, and I did not hear this come up, so I was surprised that the position was opposing S-4.

Maybe you want to clarify that.

[Mark Warawa, Conservative, Langley, BC]

Legislation can begin in either the House of Commons or the Senate, so S-4, because of the “S” in front of the number instead of a “C”, indicates it began in the Senate.

Mr. Smith, is there a reason that the Canadian Chamber of Commerce did not make a submission in the Senate?

[Mark Warawa, Conservative, Langley, BC]

Thank you to the witnesses.

The Canadian Chamber of Commerce and the Canadian Marketing Association, did either or both of your organizations make submissions to the Senate hearings in dealing with S-4?

[Annick Papillon, NDP, Québec, QC]

Thank you, Mr. Chair.

Bill S-4 can force private sector organizations to report any losses or breaches of personal information. The test proposed for this mandatory reporting is subjective since it enables the organizations themselves to determine whether it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

In your view, can we ask organizations to determine themselves what constitutes significant harm? Would that assessment not be too subjective? What do you think about that?

[Judy Sgro, Liberal, York West, ON]

Thank you very much, Mr. Chair.

Welcome to our guests.

The whole intent is on how we better ensure through Bill S-4 that Canadians are protected and that the appropriate law enforcement and so on have the tools they need to do their jobs. I think that's what everybody wants to see happen. Whether Bill S-4 accomplishes that or not is fully questionable.

Mr. Smith, you mentioned the issue of network information security in particular . Would you elaborate a bit more on that?

[Scott Smith]

There are a couple of ways to answer your question.

The legislation has been in place for over a decade now and it's working well. As you heard, businesses are reporting.

There are incidents. These breaches are increasing. You hear about them in the media. Generally, those are not the fault of the businesses. They're being attacked in a number of different ways. If you're talking from a cybersecurity perspective, they have challenges in being able to protect themselves against that. That's not unique to business. That's happening to government. It's happening to everybody. You heard that even the U.S. government was attacked.

From a small business perspective, they look at PIPEDA and are doing what they can to comply. Most of the breaches that you don't hear about are being handled at the front lines and reported to individuals. It's not coming back to the Privacy Commissioner at all. Generally there's no need for it to come back because there is no risk of harm to that individual once the breach has been dealt with. Systemically, they're managing these internally.

Is business preparing for the changes to PIPEDA that are coming under Bill S-4? They're certainly aware of them. Will they make any changes? Not until the bill comes into place, I would suspect.

[David Elder, Special Digital Privacy Counsel, Canadian Marketing Association]

Thank you very much, Mr. Chairman.

Again, I'd like to apologize on behalf of my colleague Mr. Hill, who was delayed twice this morning on a plane. We all know what it's like travelling in this great country of ours at this time of year.

Thank you to the committee for the invitation to appear before you today, to comment on the digital privacy act, or Bill S-4.

The Canadian Marketing Association, or CMA, is the largest marketing association in Canada, with some 800 corporate members embracing Canada's major business sectors in all marketing disciplines, channels, and technologies.

The CMA is the national voice for the Canadian marketing community, and our advocacy efforts aim to promote an environment in which ethical marketing can succeed. With a few caveats, the CMA supports the government's initiative to update Canada's private sector privacy law. I should highlight two elements of particular importance to marketers.

First, the digital privacy act clarifies the definition of business contact information, so that electronic business addresses are treated in a manner consistent with that found in other privacy laws. This is an important and welcome change which businesses requested during the last review of PIPEDA.

Second are the breach notification provisions. During the last PIPEDA review, the CMA encouraged the Privacy Commissioner to develop national breach notification guidelines, which were issued in 2007, after consultation with stakeholders. The S-4 breach provisions build on those guidelines and will bolster consumer confidence that organizations will safeguard their personal information. This is especially important in 2015, when so much of our commerce occurs through digital channels.

We agree with the views and proposals presented by the Chamber of Commerce. I'd like to elaborate, however, on two of the issues addressed by my colleague.

First, proposed section 10.3 in the bill requires that organizations keep and maintain a record of every breach of security safeguards involving personal information under its control. This is of some concern, because the term “breach” is very broad, and there can be many technical breaches that could include any unauthorized access or disclosure of personal information no matter how mundane or non-sensitive.

There's no mention in this record-keeping requirement of a standard of materiality. All breaches will have to be diligently logged in a prescribed manner, even when there is clearly no risk. This could become an onerous obligation for businesses, especially for small and medium-sized businesses.

It creates several other challenges for organizations. There's the cost of gathering and storing that information. It also runs counter to good privacy practices to unnecessarily retain such personal information, especially for what appears to be an indefinite period of time.

Finally, one of the issues with this record-keeping concern is that it's one of the very few provisions in PIPEDA a violation of which constitutes an offence over the act. Consistent with what Mr. Therrien said this morning about how businesses have approached reporting breach notifications, I think you will also have a situation here in which we may have overcollection because businesses want to be onside with the law. As well, a great deal of effort and material will be spent cataloguing very minor breaches.

The CMA recommends that a materiality threshold be introduced as outlined in the business coalition brief. At a minimum, it's very important that the materiality threshold and retention period be addressed, first with a reference in the law, and then possibly through a more detailed regulation.

The second issue I'd like to talk about is clause 5, which proposes a new section 6.1, which elaborates on the definition of what it means to obtain valid consent. The minister has explained that this clause is intended to reinforce existing best practices, to protect certain groups, such as children, who may have more difficulty understanding privacy and related consent language.

Incidentally, the CMA has long required that its members afford special consideration for young people. The OPC, has also noted favourably how the CMA code of ethics and standards of practice puts in place special consent provisions for the collection, use, and disclosure of personal information from children and teenagers for marketing purposes.

However, in addition, the OPC has already, under the existing wording, issued decisions requiring that extra care be exercised to ensure that young people understand an organization's privacy practices, and has further produced guidelines indicating that organizations should recognize and adapt to special considerations in managing the personal information of children and youth.

There's a presumption, as you would well know, in statutory interpretation that each provision is supposed to do something. It's often said that the legislatures don't speak in vain. The question here is, what does this new provision do? If we already have a provision that requires generally that individuals understand what their information is being used for and give consent based on that knowledge, what additional does this do?

I think the concern here is that the clause, as written, could lead to a broad interpretation with additional obligations. We've heard that the concern is about children and vulnerable groups. However, that's not what the bill says. It's much broader than that, and we would like some clarification of that bill.

Actually, our recommendation would be to drop this clause or, as a fallback, to amend it to clarify that it is intended to apply only to vulnerable groups.

Canadian marketers and the CMA fully recognize that consumer confidence is of paramount importance and that respect for personal information is a key ingredient. The preamble to PIPEDA states that the law is intended to promote electronic commerce by protecting personal information. Sound privacy protection practice is good for consumers, good for businesses, and good for our economy.

We thank the committee for its attention and would be pleased to answer any questions you might have.

[Scott Smith, Director, Intellectual Property and Innovation Policy, Canadian Chamber of Commerce]

Thank you, Mr. Chairman and members of the committee. The Chamber of Commerce appreciates the opportunity to address you on the subject of Bill S-4 and the changes that are proposed for the Personal Information Protection and Electronic Documents Act.

There has been much effort exerted in crafting this bill. As you're aware, there have been several iterations of it over the past few years. This is certainly not the first attempt at making changes to what is arguably the envy of other countries that are now just waking up to the principle of accountability.

This is principles-based regulation, and it provides guidance to business regarding their privacy obligations, avoiding overly prescriptive rules while at the same time permitting the necessary level of flexibility that leads to innovation.

In short, PIPEDA is a balance. Making legislative change without tipping that balance is a delicate matter. We would argue that the changes proposed in Bill S-4 are a successful attempt at maintaining the balance. The recommendations I'm going to be providing are very much procedural in nature and are not intended to fundamentally alter the spirit or intent of the bill. I'd like to characterize my comments as an opportunity to draw the committee's attention to specific provisions of the government's proposal that might benefit from targeted revisions that would align the changes to current industry practices while still meeting the government's objectives.

We support the objectives of Bill S-4 and the various proposed changes to PIPEDA that will bring some additional certainty and improvements to the overall PIPEDA framework, such as the new provisions regarding disclosure of personal information in the course of business transactions. These would broaden the scope of the exemption for business contact information to cover any information that is used to communicate or facilitate communication with an individual for business, employment, or professional purposes.

We are proposing targeted changes in four specific areas: one, valid consent; two, breach notification thresholds and record keeping; three, public disclosures; and four and perhaps most important, network information security.

The new valid consent provision in Bill S-4 denotes an obligation on organizations to pay particular attention to vulnerable individuals. While this is principles-based and broad in scope, the narrative around this provision has focused on specific categories of individuals. We see this as a concern for organizations that market broadly.

We also see it as unnecessary. I think you heard from the Privacy Commissioner this morning as well that this is a provision that, while he suggests it may be useful, isn't necessarily required. Section 5 of the act obligates every organization to comply with the model code, which is schedule 1. Section 4.3.2 of the model code says that for consent to be meaningful, “the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed”. In our view, this principles-based approach already captures the intent of Bill S-4, and we think the bill could be improved by simply deleting that clause.

The objective of notifying individuals in order to mitigate the risk of significant harm is quite different from the objective of notifying the Office of the Privacy Commissioner in order to catalogue breaches. This distinction is captured in the OPC guidelines from 2007 that define a real risk of significant harm and what constitutes a material breach. This dual threshold has been in practice for over a decade and is working well. In these cases there is no material breach, and the OPC reporting requirement would be onerous for both the organization and the OPC.

We encourage language that allows organizations to assess the risks associated with a breach and the OPC to issue guidance on what constitutes a material breach that triggers a reporting requirement, in other words, the existing regime.

Because there is no definition of what constitutes a material breach, record keeping is also problematic. Many occurrences, such as an unlocked filing cabinet with employee records, technically constitute a breach but have no material consequences. Keeping records in the prescribed manner for an unspecified time period when there is no impact on the privacy of an individual and the failure to keep those records constitutes a criminal offence is an unreasonable burden on organizations.

Also, with respect to what constitutes a material breach, we note that the compliance agreements should be directly linked to and focused on the requirements of PIPEDA to ensure transparency and clarity in the act regarding what companies must do to avoid finding themselves in a situation that might warrant a compliance agreement in the first place.

As drafted, proposed new section 17.1 raises concerns that overly broad language, for example, “any terms”, could result in potential jurisdictional overreach by the Privacy Commissioner. This limitation should be accompanied by a reasonable notice period.

Also, in clause 17, we are concerned that an exception to the general prohibition on disclosure granted to the Privacy Commissioner is out of step with other Canadian statutes, such as the Competition Act, and may have the unintended consequence of undermining current cooperative relationships and information sharing.

I've just spoken about the modifications we're recommending. We believe there's one very important omission in Bill S-4 that does warrant your consideration, which brings me to network information and security. The average number of days that a threat can reside on a network undetected is 229, and networks extend beyond individual organizations.

On February 13, President Obama issued an executive order calling for improved private sector cybersecurity information. This order recognizes that countering cyberthreats, private companies, not-for-profit organizations, executive departments and agencies of the government, and other entities must be able to share information related to cybersecurity risks and incidents and collaborate to respond in as close to real time as possible. We believe the same mechanisms are necessary here in Canada.

While proposals under Bill S-4 provide some limited exceptions to allow for collection, use, and disclosure of personal information, changes are needed to provide organizations with a legal certainty to effectively manage these threats. We are interpreting that network information security processing falls within the scope of PIPEDA since data processed for network information security purposes is often personal information like a name, an IP address of a botnet zombie computer, or an e-mail address. We are essentially asking for a clear-cut exception for network security information processing so that organizations have legal certainty and aren't forced to curtail network information security processing or operate in a legal grey area.

Our specific recommendations for text changes were submitted by the Canadian Chamber of Commerce on behalf of a coalition of businesses and organizations, and I urge you to consider those recommendations in the spirit of crafting the most effective privacy legislation.

Thank you for your consideration.

[Daniel Therrien]

We have done that in the form of guidance to organizations, asking organizations to use plainer language when they seek consent. That's obviously only an incomplete answer, but at the end of the day, it is organizations that know the service they are providing and know what kind of information they need, so they're in the best place to inform consumers and individuals. We're urging them to use as plain language as possible.

That being said, consent is a huge concern. We think that Bill S-4 is a step in the right direction with the clarification to the definition found in it. But as I indicated before, we're consulting stakeholders on what our priorities should be for the next several years on how best to improve the situation for individuals. The consent that they provide will almost certainly be among our priorities.

[Daniel Therrien]

I would say that we have worked on complaints involving children, and we have been able to set certain parameters for how to obtain consent when the services provided by the organization are of interest to children, so it's not that we are currently without any tools to ensure the ability of consent generally and for children specifically.

That being said, I think it is useful to provide, to have the clarification that Bill S-4 proposes to have so that organizations see clearly from the definition of consent in what would be the new provision of PIPEDA, that they have to think about the clientele to which they're offering products and services. This probably is happening to some extent. Certainly it's happening to some extent for organizations, but it may not be happening for all organizations, and to have this clearly in legislation, that you must think about your clientele, I think would be useful.

Is it that are we without tools currently? No, but it would be useful to have this addition.

[Peggy Nash, NDP, Parkdale—High Park, ON]

I'd like to pursue the questions of Mr. Warawa around consent, because it is a topic that is certainly addressed in Bill S-4, and it's a very important topic that most people truly don't understand in an era of rapidly changing technology.

I discovered to my surprise that I ended up owning one of these TVs. It's a good thing I never get to watch it, but it apparently has the potential to be allowing someone to listen in. It would be pretty boring, but....

I wanted to ask you specifically about children. You did mention the consent of children. We're going to be hearing from the Chamber of Commerce, and they have said in their submission that your office has not been hampered in its efforts to protect children through ensuring valid consent; therefore, a specific valid consent amendment is not needed. What's your view on that? We'll ask this question also to the chamber, but do you believe that a specific valid consent amendment for children is needed?

[Daniel Therrien]

We could spend a whole day on this issue of consent. Obviously, whether people provide consent with all knowledge of the consequences of their giving consent is a huge issue, and in many, many cases consumers, individuals, do not realize what they are consenting to. There's no question about that.

How does one ameliorate the situation? We think education is a big part of it. Guidance from the office is a big part of it for organizations and individuals. Is it possible to legislate this? The proposed definition of consent in Bill S-4 I think is a useful addition, but obviously you cannot prescribe all the potential situations where consent will be sought in the marketplace, so legislation has its limits. I think with the clarification that Bill S-4 provides, it is a useful clarification of what consent is, and it has the potential of improving the situation for the issue of consent sought from children, because the definition in Bill S-4 requires organizations to put themselves in the shoes of the individual whose consent is being sought: what does the individual understand? So, when the individual is a child, if your product is addressed to children, you should think about what is reasonable to expect of a child in understanding the consent being sought. Overall, I think, again, the definition of consent in Bill S-4 will assist generally and will assist particularly groups that are more vulnerable, like children.

[Annick Papillon, NDP, Québec, QC]

Very well.

Bill S-4 could force private sector organizations to report any losses or breaches of personal information. However, unlike what is set out in Bill C-12, the test proposed for this mandatory reporting is subjective since it enables the organizations themselves to determine, and I quote:

if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

In your view, is that test reasonable?

[Annick Papillon, NDP, Québec, QC]

Thank you, Mr. Chair.

When Minister Moore appeared before this committee a few days ago, I asked him whether the office would have sufficient resources and funds to accept the new and major responsibility that will follow once Bill S-4 is passed. He said that you had the resources you need for that.

Is that really the case?

[Daniel Therrien]

The first point I would make is that we can devise a breach notification regime in any number of ways. The one that you have in front of you is a good compromise. It's reasonable. Is there a better system conceivable? Probably. What I would ask you to do is to adopt that regime because the main point is we need mandatory breach notification.

Is it appropriate to leave organizations with the duty or the discretion to notify or not? In practical terms, we see that in Alberta, which has a similar scheme, but also federally with the voluntary breach notification that we've enforced for the past few years, organizations by and large do not under-report. They over-report. They want to report borderline cases because they don't want to be seen as under-reporting. Moreover, in Bill S-4, there will be penalties for those who under-report. Again, is this the best regime possible? Maybe, maybe not. I think it's reasonable overall and should be adopted.

[Daniel Therrien]

I reiterate what I answered to Madam Nash, namely, yes, C-13 and S-4 on the issue of warrantless access to information create challenges and issues.

The decision of the Supreme Court in Regina v. Spencer is extremely useful and sets good parameters. I think it would be useful to go a step further and to further clarify lawful authority with a combination of the decision of the Supreme Court in Spencer plus a clarification of the circumstances where government can collect without warrant when there's no reasonable expectation of privacy. I think that would be a reasonable regime.

[Judy Sgro, Liberal, York West, ON]

The combination of C-13 and S-4, the impact of both of those pieces of legislation will be fairly significant, from what I understand.

Do you have any additional concerns over what you have mentioned specific to S-4 once those two are combined?

[Judy Sgro, Liberal, York West, ON]

We're glad to have you here.

I have a couple of questions.

How are Canadians going to be better off with Bill S-4? We know certainly some of them...front level, but I'm concerned with some of the other possible breaches and your ability as a department to pursue them.

[Daniel Therrien]

It's for two reasons, essentially.

Point one, I totally agree that there needs to be provision in PIPEDA allowing organizations to address the issue of fraud or breaches of agreements that they may face. The question is how to do it. The current regime, I think, is preferable to what is proposed in Bill S-4 in that, first, it does not allow for fishing expeditions, so that the threshold for the suspicion an organization has that there might be fraud involved is at a higher level, which I think is preferable. Second, the investigative body regime calls for transparency and publicity—we know what the investigative bodies are—as opposed to the proposed modifications whereby any organization could share information with any other organization, so that there would be less transparency, as well as room ultimately for fishing expeditions.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair. Good morning, members of the committee.

Thank you for the invitation to present our views on Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act.

With me today are Patricia Kosseim, senior general counsel, and Carman Baggaley, senior policy analyst.

Ms. Kosseim and Mr. Baggaley appeared before the Standing Senate Committee on Transport and Communications on Bill S-4, shortly before my appointment as Privacy Commissioner was confirmed. My views on Bill S-4 are largely in line with the office's position as presented at that time.

I will however be addressing in more detail the proposed amendment that allows organizations to disclose personal information to other organizations without consent. I will also discuss paragraph 7(3)(c.1) disclosures in light of the Supreme Court's Spencer decision.

Let me first say that I am greatly encouraged by the government's show of commitment to update the Personal Information Protection and Electronic Documents Act, and I generally welcome the amendments proposed in this bill.

Proposals such as breach notification, voluntary compliance agreements and enhanced consent would go a long way to strengthening the framework that protects the privacy of Canadians in their dealings with private sector companies.

Mandatory breach notification will bring enhanced transparency and accountability to the way private sector organizations manage personal information. I support the risk-based approach that will require organizations to assess the seriousness of each incident and its impact on affected individuals.

I believe that the organization experiencing the breach is in the best position to assess risk and decide whether notification of individuals is warranted. Requiring organizations to keep a record of breaches and provide a copy to my office upon request will give my office an important oversight function with respect to how organizations are complying with the requirement to notify.

The proposed voluntary compliance agreements will enhance my office's ability to ensure, in a timely and cost-effective manner, that organizations are meeting their commitments to improve their privacy practices without having to resort to costly litigation before the Federal Court in conditionally resolved cases.

As for the proposed provision that aims to enhance the concept of valid consent, I believe that this is a useful clarification of what constitutes meaningful consent under PIPEDA. It underscores the need for organizations to clearly specify what personal information they're collecting and why in a manner that is suited to the target audience.

While I support many of the amendments proposed in this bill, I nevertheless have strong reservations about proposed paragraphs 7(3)(d.1) and (d.2). These proposed provisions would allow an organization to disclose personal information without consent to another organization in certain circumstances. My concerns are twofold.

First, I believe that the investigative body regime as it currently exists in PIPEDA and which paragraph 7(3)(d.1) and (d.2) seek to replace provides important transparency and accountability safeguards that will disappear with the proposed amendments.

Currently under PIPEDA, organizations can disclose personal information without consent to investigative bodies designated through a transparent governor in council process. The list of organizations with investigative body status is publicly available. Under the proposed amendments, potentially any organization will be able to collect or disclose personal information for a broad range of purposes without any mechanism to identify which organizations are collecting or disclosing the information and why.

Furthermore, the proposed provisions seek to dilute the thresholds and grounds for disclosure that currently exist under the current investigative body regime in paragraph 7(3)(d). I would prefer to maintain the existing investigative body regime. However, if that is not possible, then I would recommend keeping the existing PIPEDA thresholds found in paragraph 7(3)(d) and grounding disclosures in real problems rather than fishing expeditions.

This would mean three things: first, the threshold under paragraph 7(3)(d.1) should be based on a “reasonable grounds to believe” that the information relates to an actual breach or contravention; second, the threshold under paragraph 7(3)(d.2) should be based on a “reasonable grounds to believe” that the information relates to the detection or suppression of fraud that “has been, is being or is about to be committed”; and third, disclosures under paragraphs 7(3)(d.1) and 7(3)(d.2) should only be permitted on the initiative of the disclosing organization.

In addition a mechanism for enhancing transparency and accountability around these disclosures would be needed. For example, disclosing organizations could be required to issue transparency reports and to document the analyses undertaken in deciding to disclose under these provisions.

Finally, I would like to address the Spencer decision and how I believe it impacts paragraph 7(3)(c.1 ) of PIPEDA.

ln the Spencer decision, the Supreme Court held that police need a warrant or a court order when seeking subscriber information from an organization subject to the act.

ln the court's view, there is a reasonable expectation of privacy in subscriber information connected with online activity and the police request that the organization voluntarily disclose this information constituted a search that violated the Charter. I believe that this decision is a significant step forward in protecting privacy, but it leaves unanswered the question of what types of information attract a reasonable expectation of privacy and the related question of when organizations may voluntarily disclose other types of information in response to a police request.

As a result, organizations are left in a state of uncertainty and ambiguity as to when they may or may not disclose personal information without warrant and it leaves individuals in the dark about when their personal information may be disclosed to state authorities without their consent or prior judicial authorization.

I would therefore urge the committee to recommend putting an end to this state of ambiguity by clarifying when, post-Spencer, the common law policing powers to obtain information without a warrant may still be used. I believe that a legal framework, based on the Spencer decision, is needed to provide clarity and guidance to help organizations comply with PIPEDA and ensure that state authorities respect the Supreme Court of Canada's decision.

More specifically, I would recommend that Parliament provide greater clarity and transparency by amending PIPEDA to define “lawful authority” for the purposes of paragraph 7(3)(c.1) in line with the Supreme Court's decision, that is, where there are exigent circumstances, pursuant to a reasonable law other than paragraph 7(3)(c.1), or in prescribed circumstances where personal information would not attract a reasonable expectation of privacy.

Thank you for your attention. I would be happy to answer any questions you may have.

[The Chair, Conservative, David Sweet]

Good morning, ladies and gentlemen.

Welcome to the 34th meeting of the Standing Committee on Industry, Science and Technology where pursuant to the order of reference of Monday, October 20, 2014, Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act, is what our study is right now.

We are grateful to have before us the Privacy Commissioner of Canada, Daniel Therrien. With him are Patricia Kosseim and Carman Baggaley.

We have a second panel at noon, colleagues, so we will begin with the Privacy Commissioner's testimony and then our rounds of questions.

Mr. Commissioner.

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you, Mr. Chair.

Again, I want to emphasize that I think there are many provisions in this bill that Canadians are looking for and feel are long overdue, and they are happy to see. I think it's unfortunate that there are some other provisions in this bill that are creating a lot of concern. Canadians are very concerned about their digital privacy, which is why this bill is being brought in. Yet, the area of warrantless disclosure is one that has been highlighted. It was highlighted at the Senate committee. While there may be absolutely legitimate areas where it makes sense to have warrantless disclosure, it's the lack of oversight that's troubling here.

I just want to cite quickly a couple of pieces of testimony on Bill S-4. First of all, Peter Murphy, who is a partner at a Canadian law firm, Gowling Lafleur Henderson, says again there are some welcome changes in Bill S-4. But he also goes on to comment in particular on the provisions allowing for disclosure of personal information without consent between organizations in support of investigations and breaches of law agreements or fraud cases of financial abuse, and I'm quoting:

This change would seem to permit fishing expeditions by companies seeking to sue individuals. For example, copyright holders would have grounds to freely obtain lists of internet addresses of individuals to find and sue internet downloaders. This seems to be a significant invasion of privacy if reasonable controls are not added to the proposed wording.

Michael Geist, who is a law professor here at the University of Ottawa, is an expert on digital matters, and he says:

Unpack the legalese and you find that organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. This applies both past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person (who therefore cannot challenge the disclosure since they are not aware it is happening).

So, my question is, why is there not greater accountability, greater oversight, to ensure that this provision, if you do believe it is necessary, is not abused?

[John Knubley]

To answer your question I think the first step is always to ask if there is a warrant. The next step is to ask if there are any limited areas where consent is not required, and there are some very specific areas where that applies. That's the way the digital privacy act works.

I should be clear that this law does not apply to the police. This is a law that applies to the exchange of information from businesses to citizens.

[Chris Padfield]

For those specific provisions, currently under PIPEDA there's a regime called the investigative body regime. It lists a number of entities that are allowed to do these activities now. The range of entities that are there are, for example, the bank crime prevention organization that works for the bank association. They share information back and forth among banks around people who have been robbing ATMs. They have videos at ATMs. They use and share that information without the thieves' consent so they can identify and do an investigation into the crimes. I've visited them. They share information across the country from different banks on people who are stealing from ATMs or robbing right inside the location. It's that kind of sharing we're talking about in that context.

Under the current investigative body regime there are those kinds of sector organizations. Then there are professional associations, such as professional engineers associations, colleges of physicians and surgeons, and the Law Society of Upper Canada, that do investigations into their own members in assuring that their own members are following the code of conduct for their organizations.

You have a third grouping such as forensic auditors who do that kind of activity on behalf of somebody else.

They share information without consent in the course of investigations. These investigations are generally for other public policy purposes in protecting Canadians from crimes, as in the bank example. That kind of information gets flowed back and forth.

What Parliament recommended in the first review of the act was to take an approach of regulating the activity rather than regulating the specific entities, which is the approach that B.C. and Alberta have taken. Rather than having the prescribed list of organizations that has to be updated—if you change your name, you have to go through regulation to have your name changed in the regulation—they said regulate the type of activities rather than regulate the individual entities and put them all on a list in the back.

That's what S-4 has done. It's taken that investigative bodies regime and split it into these two other sections to go and regulate the type of activity rather than the bodies themselves. That's what Parliament recommended and that's what B.C. and Alberta do now.

[John Knubley]

Basically, the act and amendments impose obligations of that nature on organizations. Bill S-4 sets out new obligations.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

I'd like to pick up on the part of Bill S-4 that concerns the transfer of information between the organizations.

I'd like to first say I think it's very commendable to have a bill that seeks to protect the elderly and young people when they are sharing information online. But I am troubled by the total lack of oversight when it comes to public institutions sharing information among one another, including law enforcement agencies. The information is being shared without the individual's consent or any monitoring. There is an absence of any civil liability in that regard.

Don't you think the bill should be amended to address that? The Privacy Commissioner is involved, especially when it's a matter of security, but in other cases, as I just pointed out, the information is being shared without any oversight.

[Chris Padfield]

If I understand the question on the data breach provisions correctly, with regard to whether it's the private sector making the risk assessment versus the data breaches going specifically to the commissioner and having the commissioner review all the data breaches, in the approach that has been put forward in Bill S-4, the outcomes end up being the same.

When an individual company does an assessment of the risk of the data breach and whether there's going to be harm to the individual, they go through the procedure for figuring out whether they have the risk. Once they've identified that there's going to be a risk of harm, they identify both the individual and the Privacy Commissioner. At the same time, when they've done that assessment and they've reviewed the data breach, if they've found that there is no risk of harm, they're required to maintain a record on those and the commissioner can ask for those records at any time. They could ask the individual company to report all of those records to them at any time. So the commissioner has access to the same types of information and can review all those at any time.

The end result is the same. The commissioner has access to any and all data breach records at any time he wants, whether there's a real risk of significant harm or otherwise.

[Annick Papillon, NDP, Québec, QC]

Bill S-4 would require organizations in the private sector to report any loss or breach of personal information. But the criterion on which that mandatory reporting is based is subjective. In fact, the bill allows organizations to determine, themselves, if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

Why didn't the government choose a more objective criterion as the basis for that determination, such as the one proposed in Bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), which was introduced by my colleague?

[John Knubley]

Mr. Chair, I'll be very short.

I want to talk about two things. One is the basic objectives of the act, and the Minister referred to them. I also want to talk about some of the principles and objectives in terms of the design of the bill, which I think are important to understanding why the bill is the way it is.

Bill S-4 makes four important changes.

First, it requires companies to tell Canadians if their personal information has been lost or stolen, and they've been put at risk as a result.

Second, in the area of consent, it clarifies that actions taken to obtain consent must be appropriate to the target audience. We heard earlier about the particularly vulnerable group of children. In the area of consent it modifies the very limited circumstances—and we would want to stress, very limited—when personal information may be shared without consent in order to balance against other important public policy objectives, for example, if a bank or financial adviser suspects that one of the clients is a victim of financial abuse.

Third, Bill S-4 gives the Privacy Commissioner a range of new tools and greater flexibility to enforce the act.

Fourth, it take steps to reduce the burden on businesses and to allow them to use this information in relation to their ongoing work and due diligence relating to various business transactions.

On the design side—and this is what I think is probably most important as an administrator to bring to your attention—it is really two concepts. I think this came up in the earlier discussion. One is the issue of balance and the other is the issue of principles. This is a bill based on principles.

As we make amendments and look to the future we want to maintain a concept of balance and build upon a principle-based approach that has made PIPEDA successful. These principles are set out in the annex to the original act and include important concepts such as accountability, consent, accuracy, safeguards, and openness.

In light of some of the earlier questions I would stress that openness is a principle that we constantly look to and applies, for example, in the question of the use of information between businesses. Of course it is all about ensuring that citizens have the right to know.

In terms of balance, I'll make a couple of quick points. Ensuring Canadians have the information they need so they can take action to protect their privacy is a priority. Equipping the Privacy Commissioner with the information and tools needed to protect Canadians and increase compliance is a priority. Providing clear rules and a minimal administrative burden on the private sector is a priority. These are not priorities that always mesh and the question of balance comes into play.

In conclusion I want to say that while every country takes a unique approach to addressing privacy—the United States, for example, has a more regulatory-driven approach and the European Union a much more proscriptive approach—we think we have a world-leading approach to the administration of privacy here in Canada and that's reflected in these amendments. We hope to continue to be a leader internationally in this regard.

Thank you, Mr. Chair.

[Annick Papillon, NDP, Québec, QC]

Yes, I'm going to continue.

Bill S-4 would give the Privacy Commissioner additional powers to enter into compliance agreements with organizations. In light of the fact that the date of the budget has been postponed numerous times—it won't be before April—has the government committed additional financial and human resources to the commissioner so that he can fulfill his new functions?

You have been in power for nearly 10 years and you are preparing a new budget. Can you assure us that the commissioner will have sufficient financial and human resources to do the job properly?

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

It can be reviewed at any time. This committee can choose its own business. You can review it the day after, if you like. The committee can do whatever it wants. But as my deputy points out, this is the third time we've taken a run at this legislation and updating PIPEDA, so there is some urgency.

I was in opposition for two terms and I understand the nature of chastising governments for reasons real and imagined. That's fine, but one of the reasons we took the approach, why it is Bill S-4, and why we tabled it in the Senate first, is that this committee had a very full agenda. Parliament itself had a very full agenda, with a number of high-profile and complex pieces of legislation through the fall session of Parliament, and we wanted to get going on this. We wanted to get forward traction.

Of course, our legislative process requires it to have the support and consent of both houses of our bicameral legislature. We wanted to get it passed and moving forward, keeping in mind that we do have a campaign coming up this fall and House time is precious and limited. We reversed the process for that reason: because we do want this legislation to get passed and we do want it to go forward.

We see it as essential for a number of reasons, including taking full advantage of the digital economy and protecting Canadians online. There is I think a growing anxiety and an expectation amongst Canadians that the government do all it can in order to protect the privacy of Canadians online, not only in terms of the Privacy Act and citizen engagement with the Government of Canada in ensuring that their privacy is protected when they provide their information to the government, but also when they are doing so in the private sector.

It has now passed the Senate after consideration and deliberation, and there are a number of amendments that were debated at committee. This committee of course can fill its schedule and consider this legislation as it wishes, but it certainly is my desire that the bill move forward and be adopted so that we can protect Canadians and give Canadians the confidence they deserve.

[Mark Warawa, Conservative, Langley, BC]

Thank you, Minister.

Chair, we will be discussing this in great detail. We'll be calling a number of witnesses. The reality is that in our calendar we have about 15 meetings in the rest of this Parliament. If it's not passed, forwarded to the House and then passed, this will not be going ahead in this Parliament. I believe it's needed. I believe we've heard—and the Senate heard—that this reaches the balance.

Minister, just to reconfirm, there is a review built into Bill S-4. This will be reviewed in five years to see if it's effective and if there are any problems with it. Is that correct?

[Mark Warawa, Conservative, Langley, BC]

Thank you, Chair.

Thank you, Minister, for being here.

I think it's very important that we protect the rights and the personal information of Canadian consumers. We realize, with regard to the digital economy and how it's evolved so dramatically over the last few years, that it's important that we address the concerns we hear from Canadians.

With respect, Chair, I hear from the NDP that we should maybe amend what has come to us from the Senate.

Minister, if we were to delay and amend, would Bill S-4 then have to go back to the Senate to get passed? My concern is that this is needed, Canadians want this, and a vast majority of Canadians want this passed, and if we amend it, what's the chance of it passing in this Parliament? It's needed.

[John Knubley, Deputy Minister, Department of Industry]

I think this is an area of important clarification. There may be two sets of points, and I'll ask my colleagues to help me on this.

First, I think we believe, as administrators, that we are not opening the door wider in this regard. What we are actually doing is bringing PIPEDA in line with the practices of other provinces like Alberta and B.C. here. Currently, we apply regulations in these specific areas of non-consent, and we're moving away from that to a series of tests we think are as rigorous as the regulation.

In terms of Bill S-4 itself, there is a series of amendments relating to business contact information and business transaction, for example, businesses in a merger, an acquisition; if it's specifically related to a work product, which requires ongoing business, and consent is not easily arranged; in the area of insurance; and in the area of employee information when termination is involved. All to say these are very specific circumstances where we think there are very legitimate and reasonable grounds for businesses to work with and share information among themselves.

I know, Kelly, you have some further information on this.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

That's a good question.

It's not always easy to figure out. Hence the importance of making sure that, whenever you give your credit card number to a supplier online, you have to read all the fine print, so to speak, because, at the end of the day, you are giving an organization your legitimate consent to share your personal information.

It's vital that, when using technology, consumers be extremely careful with their personal information. For that reason, Bill S-4 has a provision meant to protect young people, because they are the most vulnerable to these kinds of violations.

It's challenging for a government to put in place laws and regulations to protect people in their online communications. We believe this legislation gives the commissioner the powers needed to protect Canadians.

It's an ongoing debate in society and the media, not to mention within families. Whenever a breach of personal information occurs, we have to try to understand what went wrong and adopt new measures to protect individuals.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

That's a good question.

In our view, Bill S-4 clearly defines the obligations organizations and businesses are under in that regard. Once the bill comes into force, if any organizations have questions or need clarification, they can certainly speak to the people in my department or contact the Office of the Privacy Commissioner of Canada.

We introduced this bill to address the need to balance the rights of Canadians and the right to privacy. As I said in answer to Mr. Lake's question, we need to make sure that we are not creating barriers for organizations and businesses wishing to fully participate in the digital economy.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

Good morning to you, to the minister and his officials, and to all my colleagues around the table.

We are talking about Bill S-4. In today's technological environment, it is indeed important to bring forward measures like these, but it is also important to make sure that personal information is well-protected.

Let's get right into it and look at new section 7(3)(d)(i), which deals with exceptions to consent requirements. It says that the information can be disclosed if the organization "has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed".

How can an organization determine the relevance of the information it is sharing to a federal or provincial contravention, all the while protecting individuals' rights?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Minister, you said that Bill S-4 did not violate the Constitution and that the Supreme Court's decision in the Spencer case did not apply to the provisions in the bill.

Did I understand you correctly?

Was any research done in that regard, further to the Spencer decision?

[James Moore, Conservative, Minister of Industry]

Thank you very much, Mr. Chairman, and I appreciate the opportunity to come back, as you said, with my officials to talk about Bill S-4, the digital privacy act, which for me is a very important piece of legislation for a number of reasons: the context of the legislation in terms of Canada's digital policy moving forward but also our responsibility as a government, as a Parliament, to update our privacy legislation to protect Canadians.

But before I do that, I gather there were some changes in the committee membership, so I want to congratulate those of you who have been tasked to come onto this committee. As you know, the Department of Industry...and therefore your oversight of our activities, your advice, and constructive criticism, are of course an important part of our parliamentary function. To those of you who are on the committee, I look forward to working with you over the coming months as we move forward on pieces of legislation like this one here.

Thank you, Mr. Chair, for inviting me to appear before the committee today to discuss an important bill, the Digital Privacy Act, which is intended to better protect Canadians' personal information online.

You know, our government is focused on the mandate that we were given by Canadians back in 2011, to create jobs, focus on a growing Canadian economy and, as Minister of Industry, to move forward with an effective digital policy for Canada.

Also, we know that any government's plan that is centrally focused on the economy must of course have a robust engagement to strengthen Canada's digital economy. That's why last year I unveiled Digital Canada 150, our government's plan that sets clear goals for a connected and competitive Canada. It will help Canadians participate and succeed in our digital economy. One of the key pillars under Digital Canada 150 is the need to protect privacy.

The digital privacy act is an essential part of that goal. Our government understands that a strong digital economy requires strong protections for Canadians when they surf the web and when they shop online. The digital privacy act will modernize Canada's private sector privacy law by introducing important new protections for Canadians online. It sets clear rules for how personal information can be collected, used, and disclosed. It requires organizations to tell Canadians if their personal information has been lost or stolen and imposes heavy fines on companies that deliberately break the rules. It gives the Privacy Commissioner of Canada more power to enforce the law and to hold offenders to account. The bottom line is that it delivers a balanced approach to protect the personal information of Canadians, while still allowing information sharing to stop illegal activity when it occurs.

These are much-needed changes to Canada's private sector privacy law, the Personal Information Protection and Electronic Documents Act, or more commonly known as PIPEDA. PIPEDA “sets out the ground rules for how private sector organizations...collect, use or disclose information in the course of commercial activities” across Canada. This should not be confused with the Privacy Act, which deals with how the Government of Canada handles the personal information of Canadians.

Let me share with the committee four areas where the digital privacy act will significantly improve PIPEDA.

First...data breaches. Unfortunately, this is an all-too-familiar topic for Canadians in our digital age.

It may surprise the committee members to learn that, under the current legislation, businesses are not obligated to notify Canadians of security breaches involving data under their control.

In other words, if a company's data is compromised and a hacker gets a hold of your credit card number, the company is not under any obligation to notify you. That's a serious problem.

Last December, for example, Target revealed that a data breach had compromised millions of its customers' credit and debit card information. In September, Home Depot announced that a data breach perpetrated by unknown hackers left as many as 56 million debit and credit card customers across North America vulnerable to fraud. On October 10, Kmart disclosed, in the United States, that almost all of its 1,200 stores throughout the States had been attacked by hackers, putting credit card and debit card details of customers potentially in jeopardy. Later in October, Staples announced a suspected breach of its customers' credit card and debit card information as well.

Canadian online consumers need stronger laws to protect them from similar fraud here. The digital privacy act will make it mandatory for an organization to tell individuals if their personal information has been lost or stolen and whether or not it puts them at any risk.

Under the Digital Privacy Act, organizations will be required to notify individuals whose personal information has been lost or stolen and let them know whether they are at risk of harm as a result.

Companies will have to inform Canadians of the steps they must take in order to protect themselves, such as changing their credit card PIN or email password. These are crucial safeguards to protect Canadians, and yet they are not currently in place.

The digital privacy act has been praised by consumer rights groups and those in the retail industry for its balance. The Marketing Research and Intelligence Association has said that they support the mandatory breach notification requirements that are in the bill. The Canadian Marketing Association has said that they support the changes to breach provisions.

The digital privacy act will make it mandatory that organizations also report these potentially harmful breaches to the Privacy Commissioner. When there's a privacy breach, not only is the individual informed by law; the Privacy Commissioner is also informed by law. In fact it will be mandatory for all organizations to keep records of all data breaches as well. If the Privacy Commissioner makes a request for these records, they must be handed over. Once law, organizations that deliberately cover up privacy breaches and destroy records will face fines of up to $100,000 for every person or client that they intentionally fail to notify.

The Office of the Privacy Commissioner of Canada is on the record as supporting these amendments as being in the best interest of Canadians. In addition, in my home province, the B.C. privacy commissioner has also recommended to their provincial government that they adopt the same approach that we have taken in Bill S-4.

Second, our digital privacy act clarifies the rules around obtaining consent to protect vulnerable Canadians online, particularly children and seniors, when companies ask to collect and use their personal information. For example, when the owner of a website for children wants to gather information about visitors to the site, the owner will need to use language that a child could reasonably be expected to understand. If the child can't be expected to understand how the information will be used, the child's consent would not be deemed valid. The owner would need to get consent from a child's parent.

This amendment makes it clear for companies how consent works under the act. This is something about which there has been confusion. This legislation does make it clear so that they can adopt best practices.

If an organization is targeting a product or service at a particular segment of the population, such as children, then any attempt to obtain consent must be adjusted accordingly.

Again, Mr. Chair, the Marketing Research and Intelligence Association agrees with these changes, saying that it “fully supports the provisions in Bill S-4 which provide added clarity for organizations when they seek the valid consent of an individual”. Given the increased use of smartphones and tablets among young people, the stronger rules included in this bill will make sure that individual Canadians, especially children and adolescents, can fully understand the potential consequences of sharing their personal information.

The Digital Privacy Act further protects Canadians by setting out certain exceptions in which personal information can be shared when it is necessary to protect an individual from harm.

In certain situations, it is in the public interest to share an individual's personal information without their consent. For instance, the information could be shared for the purpose of reuniting parents with a sick or injured family member when they are otherwise unable to contact that family member.

Another example would be by allowing banks and financial institutions to share personal information with law enforcement or family members when they suspect cases of financial abuse, especially to protect against elder financial abuse. The Canadian Bankers Association has applauded the amendments contained in this bill that would allow banks and financial institutions to advise public guardians, law enforcement, or family members when they have evidence of financial abuse, particularly of elders.

Mr. Chair, I want to pause here to address one issue that was raised in question period when this bill was debated in Parliament before being referred to this committee. That's with respect to the Supreme Court of Canada's decision in the Spencer case. Some have suggested that PIPEDA, and the digital privacy act by extension, in some way may violate the Charter of Rights of Canadians and need to be changed.

This is patently false. PIPEDA does not create any search or seizure powers for law enforcement. It does not require companies to hand over information to law enforcement. It only allows private sector organizations to voluntarily provide information to law enforcement and government agencies when they have the legal authority to obtain it. This decision does not mean that PIPEDA or Bill S-4 is unconstitutional, and no changes to Bill S-4 are required in that regard.

Some privacy advocates, including the Privacy Commissioner, have called for greater transparency on the part of businesses with respect to how often and under what circumstances they provide information about their customers to police.

Openness, of course, is one of the key principles underscoring PIPEDA, and nothing in PIPEDA prevents Internet service providers or other companies from publishing such transparency reports. I'm pleased to see that over the past year a number of Canadian companies have done just that.

Lastly, under the Digital Privacy Act, the Privacy Commissioner will have new powers and tools to enforce the act.

The former interim Privacy Commissioner supported this legislation when she said that the digital privacy act “will strengthen the privacy rights of Canadians. We welcome proposals to introduce a mandatory breach notification regime and the compliance agreement provisions that will make it easier for our office to ensure that companies meet the commitments that they have made. We strongly support these provisions.”

I would point out as well that before we drafted this legislation and before it was presented to the Parliament of Canada, we consulted with the Privacy Commissioner's office to ensure that this legislation satisfied their concerns with regard to privacy and that we were taking all reasonable steps to ensure that concerns that had been raised in the past about this type of reform were recognized and considered in the drafting of this legislation. That's why I'm grateful for the Privacy Commissioner's support of this legislation.

Under the digital privacy act, the commissioner will now be able to negotiate voluntary compliance agreements with organizations to hold them accountable for their commitments to correct privacy problems. In addition, the Privacy Commissioner will now have one year instead of 45 days to potentially take organizations to court if they don't play by the rules. The digital privacy act will also give the commissioner more power to name and shame, or to make information public where organizations do not play by the rules. This change will make sure that Canadians are informed and aware of issues that affect their privacy. Organizations either comply with the law or they will face public scrutiny.

Our government is balancing the privacy needs of Canadians and the ability of businesses to legitimately access and use personal information in their day-to-day operations. The Canadian Marketing Association has expressed their support overall for this legislation when they said that it “supports the government's effort and this bill to update Canada's private-sector privacy law”.

The Canadian Bar Association said, “We express our support for the digital privacy act”.

As we move forward with the implementation of the act, I look forward to working with the Privacy Commissioner to provide all the necessary clear and practical guidance to help with full compliance. The digital privacy act, as I said, is a much needed update to Canada's private sector privacy law, particularly in our modern digital economy.

The bill gives Canadians the assurance that their information will be equally protected, no matter who they chose to do business with in Canada.

Thank you. I would be happy to answer any questions the committee members have.

I would certainly like to again thank committee members for their consideration of this legislation. As you know, it's Bill S-4, not C-4, and this legislation has already been adopted by the Senate. It received quite deep and thorough study on the Senate side. This was treated, I think, with a great deal of respect and the necessary intensity, and I was pleased that it was adopted by the Senate. I look forward to this committee giving it the scrutiny that it deserves.

Thank you.

[The Chair, Conservative, David Sweet]

Good morning, ladies and gentlemen.

Welcome to the 33rd meeting of the Standing Committee on Industry, Science and Technology.

We are beginning our study on Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act.

Before us we have the Honourable James Moore, Minister of Industry.

I'll also go ahead and introduce the department officials, as well—Mr. John Knubley, deputy minister; Kelly Gillis, associate deputy minister; and Chris Padfield, director general, digital policy branch. I understand, Mr. Knubley, that in the second half you'll have opening remarks.

But for now we will begin.

Minister, if you would begin your opening remarks, and then we'll have our usual rounds of questions.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I would like to come back to Bill C-13 and Bill S-4.

If these two bills remain unchanged, are you afraid they will raise legal issues? Will it have any impact on your office? Will it make your work difficult?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Great. Thank you very much.

Many bills address privacy, including Bill C-13 and Bill S-4. Bill C-44 does not deal directly with privacy, but it expands the mandate of CSIS.

Are you concerned about the lack of parliamentary or civilian oversight related to expanding CSIS' mandate?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

Mr. Therrien, I would like to thank you for your testimony. I would also like to welcome all my new committee colleagues, since this is the first time we are meeting.

In your speech, you said that there are a number of challenges when it comes to privacy. The digital world is constantly changing. The Supreme Court ruling in Spencer is a prime example. You have already underlined that adjustments should be made to the Canadian legislation, particularly with respect to Bill C-13 and Bill S-4.

Could you please provide more detail about your perspective on this matter and tell us what you think the government should do to reduce the ambiguities that followed from the Supreme Court ruling?

CSEC Accountability and Transparency Act

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Speaker, I am pleased to rise today to speak to Bill C-622, proposed by my honourable colleague from Vancouver-Quadra. The bill, on a technical level, seeks to amend the National Defence Act to improve the transparency and accountability and provide for an independent review in respect of the operations of the Communications Security Establishment, and to enact an act to establish the intelligence and security committee of Parliament. It seeks to strike an important balance between national security, the privacy of Canadians, and parliamentary scrutiny.

There was justifiable concern earlier this year when Canadians learned that CSEC was monitoring Wi-Fi services at Canadian airports. In fact, there seems to be a bit of a preoccupation with privacy rights under this government.

If we go back to the Vic Toews bill, we all remember the e-snooping legislation, which fortunately did not see the light of day, but many of the provisions were then imported into a new piece of legislation and bundled with the rights of victims of cyberbullying in Bill C-13. The most recent example is the digital privacy bill, Bill S-4, which seeks to open the door a little wider, allowing the entities that can receive private information to walk through the door that had been opened by Bill C-13. The compromising of privacy rights in Canada has been a recurring theme under this government.

Mr. Speaker, before I get too far ahead of myself, please allow me to outline the role of CSEC for those following the debate and also for members of this place who may not be as familiar as necessary to adequately engage in the debate this evening.

CSEC, or Communications Security Establishment Canada, has a three-part mandate. First, it is responsible for the collection of foreign intelligence from the global information web. Second, it is the lead agency for cybersecurity for the federal government. Third, it can use its technological capacities and expertise to assist domestic law enforcement and intelligence agencies.

There is no argument that CSEC is a vital piece of Canada's national security puzzle. Additionally, CSEC functions within a global alliance known as the Five Eyes, an alliance of partner signals intelligence agencies within the United States, the United Kingdom, Australia, and New Zealand.

Following the 9/11 attacks in the United States, the mandate of CSEC was expanded. That was 13 years ago, and we are in a rapidly evolving world in terms of national security. It seems more than reasonable to assess the mandate, effectiveness, and accountability of CSEC and its activities.

My colleague, the hon. member for Malpeque, has been quite vocal about the need for parliamentary oversight. In his capacity as public safety critic, he has repeatedly pointed out the important fact that, although Canada functions within the Five Eyes alliance I just spoke about, it is the only country that does not have proactive parliamentary oversight.

In February of 2014, my hon. colleague from Malpeque asked a question that I think deserves an answer. I am not sure he has ever received a genuine or relevant answer, so I'll pose the question here again today. I am quoting from the member for Malpeque:

The key point here is that I really cannot understand the government's unwillingness to look at proper parliamentary oversight when two of its key cabinet ministers were in fact part of a report at one point in favour of such oversight.

We know that with this particular government, if an organization that depends on government funding comes out against the government, its funding will probably be cut.

The member went to great lengths explaining the Five Eyes and the other countries that are our allies in these issues. Where does the government get the idea that Canadians are less at risk of invasion of privacy and do not need proper parliamentary oversight, when all our allies do?

Digital Privacy Act

[Annick Papillon, NDP, Québec, QC]

Mr. Speaker, that is exactly it. There are no warrants, and there is no oversight or transparency.

Canadians do not like people tinkering with their privacy. It makes no sense and, quite frankly, it is unacceptable. Bill S-4 is not designed to correct the existing deficiencies. The bill contains measures that would increase warrantless access to the information of telecommunications company subscribers, for example. That is shameful and it makes no sense. We have seen some cases of abuse recently in the news. Do we want Canada to go in that direction by letting anyone do anything with the personal information that defines our life? What would be our recourse as Canadian citizens if that were to happen?

Identity theft is a reality, and this information can circulate and be used. Even the government has lost information. At some point, we have to be aware of what we are doing. I think that in light of the fact that this is being done without a warrant, without oversight and without any kind of protection, Canadians have a reason to be concerned. That is why we are sounding the alarm.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I congratulate my colleague on her excellent speech, which really highlighted the different problems with this bill.

I would like to hear her thoughts, because she said that the government could have taken advantage of the opportunity afforded by Bill S-4 to correct the flaws in the Personal Information Protection and Electronic Documents Act, known as PIPEDA, which allow for a parallel system in which government agencies can simply ask Internet service providers to provide information on customers, such as their IP address. I would like her to talk some more about that and explain why it is important to correct these flaws in order to put an end to that non-consensual parallel system that has no oversight and no transparency.

[Annick Papillon, NDP, Québec, QC]

Mr. Speaker, I rise today to speak to Bill S-4, which amends Canada's privacy legislation. However, in its current form, Bill S-4 contains measures that will make it easier to access personal information without a warrant.

By proposing to refer this bill to a committee before second reading, the government has decided to take a new legislative route with this bill.

Indeed, the government motion aims to refer this bill to a committee before second reading. This motion will therefore allow members to examine Bill S-4 before second reading and propose amendments that will modify its scope.

We support the motion, because we hope that some of the serious concerns we have about this bill will be examined in committee. We are very concerned about the fact that one provision in Bill S-4 makes it easier for organizations to share personal information without a warrant or consent from the client, and without the appropriate oversight mechanisms in place.

In an article published in the spring 2014 journal of the Ligue des droits et libertés, Stéphane Leman-Langlois, the Canada Research Chair in Surveillance and the Social Construction of Risk at Laval University in Quebec City, gave a very clear explanation of the risks associated with industrial surveillance.

Here is what he had to say in that article:

We easily forget that every second of the day, a myriad of private entities are collecting a mountain of information on us, our habits, our behaviour, and our interactions with others...

A number of commercial entities have to collect basic information on their clients just to provide them with the service they require. A mobile phone could not work without continually indicating its location. The company also has to keep records, for billing purposes, on the calls received and made with the phone...

As you can imagine, this adds up, and after a while can represent massive amounts of data...

The information that metadata can provide about us is absolutely unbelievable. An ongoing experiment at Stanford University, with 500 volunteers willing to share their metadata, has shown that the researchers could determine financial records, health status, membership in the AA, whether the individual had an abortion or owned a gun, and many other things...

Just recently, the spotlight was on certain government intelligence agencies that were deeply involved in the widespread collection of information on Canadians. The agencies in question were specifically the RCMP, the Communications Security Establishment Canada, or CSEC, the Canadian Security Intelligence Service, or CSIS, and the National Security Agency, or the NSA, from the U.S.

Often...these agencies stop collecting or actively intercepting data and simply demand data that has already been gathered by companies...

All this may seem remote from our daily reality...but this activity has a perfectly tangible impact on our lives as ordinary citizens...

The picture being painted by Professor Leman-Langlois of Laval University, should make us realize the importance of the subject being debated today.

However, this is what this same professor and expert in security information had to say on the government's current position:

We can all agree that there is not very much privacy on the Internet, but still, there are some very weak protections in place. However, rather than strengthening privacy, which of course would be the best thing to do, the government is bombarding us with bills that will reduce those protections.

Although Bill S-4 proposes significant amendments to the Personal Information Protection and Electronic Documents Act, such as the obligation to report any breach of security safeguards involving personal information and increased powers for the Privacy Commissioner, the NDP is worried about the negative impact that some provisions of the bill will have on Canadians' privacy rights. The Conservatives have a very poor track record when it comes to protecting personal information, and Bill S-4 will not fix this troublesome past.

In just one year, government agencies secretly made over 1.2 million requests to telecommunications companies for personal information without a warrant or proper oversight. What is more, according to documents we obtained, the Canada Revenue Agency was responsible for more than 3,000 privacy breaches in less than a year. Last month, here in the House, I asked whether the government intended to follow the NDP's recommendation to set up a committee of independent experts to look at how the government uses and stores Canadians' communications data. However, as usual, the government had nothing to say. The Conservatives never gave me an answer to my question. The government should have taken advantage of the opportunity afforded by Bill S-4 to correct the flaws in PIPEDA that led to repeated violations of Canadians' privacy.

In 2012, the NDP introduced Bill C-475. This bill would have added online data protection standards to federal legislation that are similar to those in Quebec's personal information protection act. Quebec's data protection standards would have been applied to all federally registered organizations and to organizations with customers and users in Quebec. The Conservatives opposed our bill, and now they have introduced a watered-down version of the same bill.

The NDP believes that Canada needs to require mandatory reporting of the loss or breach of personal information based on objective criteria, as proposed in Bill C-475. The NDP also wants to remove the provisions from Bill S-4 that allow organizations to disclose personal information to other organizations without the consent of Canadians and without a warrant.

In order to truly protect Canadians' privacy, deterrents should be put in place to encourage or force private companies to abide by Canadian laws.

That is what the NDP is proposing, and we hope that the government will listen to us in committee, because that is what we are asking for. We think we need to get to the point, and that is why we are here. If this is not done properly, we would certainly need a committee of independent experts. As I said, I think the solution is there, but as we have seen too often, the Conservative government cuts corners and we end up with something like this.

I will now take questions.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, yet again, I listened with great interest to my Conservative colleague's speech.

I have a more specific question for him. I agree that a data breach notification requirement is essential. I even proposed a similar measure in my Bill C-475, which the member voted against.

In my model, I proposed an objective mechanism that would not make organizations themselves responsible for determining whether the data breach or leak was significant enough to notify the client concerned.

What Bill S-4 proposes is really subjective. It would have the organization make its own determination. Many lawyers, experts and academics have found this approach problematic. Does my colleague think that this approach is problematic?

[Phil McColeman, Conservative, Brant, ON]

Mr. Speaker, the legislation would provide the foundation on which the government would hold businesses to account on behalf of consumers.

It would establish new rules to protect privacy online and backs them up with more effective compliance and enforcement tools in order to strengthen the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.

Under this bill, the Privacy Commissioner would be provided with a new set of tools that would help him or her perform oversight and ombudsman functions. At the same time, the courts would continue to enforce the law and could impose significant new penalties which have been added to encourage compliance with key requirements.

Through PIPEDA, the Privacy Commissioner has the responsibility for overseeing compliance with the act. He has the power to investigate, enter premises and compel evidence. He can mediate a settlement, make recommendations and publish the names of those who contravene PIPEDA. In short, the commissioner investigates complaints and works with companies to ensure they comply with the act, but enforcement action is left to the Federal Court. Indeed, the Privacy Commissioner and the Federal Court have worked together effectively to administer and enforce the rules set out in the act.

The commissioner or any other individuals can apply to the Federal Court for a hearing on any matter related to the original complaint. It is the court, not the commissioner, that has the authority to order the organization to change its practices. The Federal Court could also award damages to individuals when their privacy has been violated and they have suffered some form of harm as a result. Under the bill before us, both the courts and the Privacy Commissioner would be given new tools, but the responsibility for enforcement action would still remain with the court.

As has been mentioned, new offences and penalties would be created for three areas relating to the new data breach rules contained in this legislation. The courts can assess penalties for: deliberately failing to report a data breach to the commissioner, as prescribed by the act; deliberately failing to notify an individual of a data breach, as prescribed by the act; and deliberately failing to maintain or deliberately destroying data breach records, as prescribed by the act.

In keeping with existing offences under PIPEDA, these offences would be subject to a fine of up to $10,000 on summary conviction and up to $100,000 on indictment. I would point out to the House that the organization can be assessed a penalty for each and every individual it fails to notify. Given the large number of individuals who could potentially be affected by a data breach, this is a very serious penalty indeed.

At the same time, the bill would give the Privacy Commissioner the tools he or she needs to monitor the impact and efficacy of these new rules and serve as an ombudsman to help reduce the number of cases that go before the courts. The Privacy Commissioner would be given the authority to negotiate compliance agreements with organizations.

Let me give the House an example. Let us assume that following an investigation or audit, the commissioner determines that an organization should take certain corrective actions to remain compliant with the law. Under Bill S-4, the organization could agree to take these actions in exchange for the assurance that it would not be taken to court over the previous breach of the rules. However, the organization would also be legally accountable for any commitments made under the corrective action.

Compliance agreements are an effective mechanism for holding organizations accountable. They allow the Privacy Commissioner and organizations to avoid costly court action and provide flexibility to suit the particular circumstances that an organization finds itself in.

I would remind the House that compliance agreements are already being used by the Commissioner of the CRTC under the anti-spam legislation and the Minister of Health under the Consumer Product Safety Act.

By adding compliance agreements to the tool box of the Privacy Commissioner, we would strengthen consumer privacy protection without fundamentally changing the framework of PIPEDA or the role of the commissioner.

However, in order for this provision to work effectively, further changes to the regime are required. For example, under PIPEDA as it now stands, the commissioner has only 45 days after he or she reports the results of an investigation to make an application to the Federal Court to seek an order to take corrective action. Experience has shown that this is not enough time for the commissioner to work with companies to implement his recommendations and there is the risk that companies would simply stall in implementing the required changes until the 45-day period runs out.

On top of these challenges, 45 days is likely not enough time to negotiate and implement a compliance agreement. That is why the bill would increase the period of time to make an application to the court to one year from the time the commissioner reports the results of his or her investigation.

Finally, I would point out that the bill would give yet another tool to encourage compliance with the data breach provisions. It would give the commissioner the power to publicly disclose wrongdoing of an organization, if he or she considers it to be in the public interest to do so. Under the current act, the commissioner has limited provisions that involve the right to make public information concerning the personal information handling practices of the organization.

However, currently, he or she cannot publicly report when, for example, organizations fail to co-operate with an investigation or repeatedly stall implementation of the recommendations to fix privacy problems. Bill S-4 would broaden the types of information the commissioner could make public concerning non-compliant organizations. This is an important tool in encouraging compliance with the act.

As technology and the marketplace evolve, the commissioner and the courts need more effective tools to help hold organizations accountable for their handling of personal information, for the protection of Canadians and their privacy.

The bill before us addresses this need with four new tools. First, it would assign significant penalties for wilful disregard of the important new data breach notification requirements. Second, it would give the commissioner the authority to negotiate compliance agreements. Third, it would extend the length of time the commissioner or individuals have to bring matters before the court to one year. Fourth, it would give the commissioner greater authority to share more types of information about non-compliant organizations with the public.

I hope honourable members will join me in supporting these new tools for the courts and Privacy Commissioner by supporting Bill S-4.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I listened with great interest to all of the Conservative members' speeches, but if memory serves and if I am in the right place on the agenda, we are debating a motion to refer Bill S-4 to committee before second reading. Every time a Conservative member rises, he says that he is talking about Bill S-4 and does not talk about the motion that we are supposed to be debating today. I understand that the two might be connected, but we are debating the motion and I think it is important to point that out.

[Phil McColeman, Conservative, Brant, ON]

Mr. Speaker, I am pleased to rise today in support of Bill S-4, the digital privacy act. Bill S-4 would provide a foundation on which the government would hold business—

[Hélène LeBlanc, NDP, LaSalle—Émard, QC]

Mr. Speaker, I am pleased to rise in the House today to support the motion to refer Bill S-4 to a committee before second reading.

Bill S-4 amends the Personal Information Protection and Electronic Documents Act. I will talk a little more about that, but first I want to take a moment to talk about the motion itself, which aims to send the bill to committee before second reading. This is somewhat strange; this is the first time the current government has done this in recent memory.

It is rather interesting and makes me wonder. Why this measure right now? Why did the government decide to do this, when there were other bills? Is it because the government has its doubts about Bill S-4 and wants to send it to committee, we hope, to solve the problems in the bill? That is what I am wondering.

Although we requested that some highly contested bills be sent to committee before second reading, such as Bill C-23 on election reform, Bill C-33 on first nations education and Bill C-3 on transporting oil along our coasts, the government refused. I have to wonder why it refused to do so and why it is now making the rather unusual—or at least uncommon, in recent history—move to send Bill S-4, a bill that comes not from the government, but from the Senate, to committee before second reading.

Procedure is not one of my strong suits, but there are experts here who can clear this up for us. I find it rather interesting that when we send a bill to committee before second reading, as this motion would do, the scope of the proposed amendments can be much broader. In other words, we could make more extensive amendments since the study in committee is not restricted by the principle of the bill, which has not yet been approved by the House. That is interesting. We can hope that Bill S-4 will be amended and that we will end up with a more polished product, if I can call it that, so that it will be more acceptable as we go into second reading.

Bill S-4 makes a pretty significant change to the Personal Information Protection and Electronic Documents Act. I took a look at this act, which received royal assent in April 2000. As members know, 14 years is an eternity in the digital world. A lot of things have happened in the past 14 years. This act was the result of an extensive consultation with a wide range of experts at all levels.

This work was accomplished through broad consultation in 2000. It is clear that since 2006, with this government, consultations are restricted to very specific groups. It is interesting to see that in 2000, there was a broad consultation that culminated with the Personal Information Protection and Electronic Documents Act. Here is what that legislation does:

An Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act.

That is the legislation that is being amended now. Another interesting part of this law is schedule 1. Certain principles were set out in the legislation about to be amended, and they are particularly interesting because they were set out in the National Standard of Canada entitled Model Code for the Protection of Personal Information. The 10 principles are as follows: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance.

I went to the trouble of reading those principles. I found them very interesting and I urge all members to read them. Like it or not, as members, we receive personal and confidential information in our riding offices. That is why we too have a responsibility to respect these principles of personal information and electronic document protection.

Right now, we are talking about a motion to refer Bill S-4 to committee before second reading. I mentioned that this has not happened often in recent parliamentary history. In the time I have left, I would like to take a quick look at what Bill S-4 will change.

This bill will make major changes to to the Personal Information Protection and Electronic Documents Act, which I just mentioned, by allowing personal information to be shared without the knowledge of the person concerned or without their consent under some circumstances. To me, that is a questionable way of protecting personal information. Companies would be allowed to share personal information under certain conditions.

As I read the bill, I really thought that there needed to be a better explanation of these conditions and some examples. For example, in a business transaction, when should personal information be shared without clients' consent?

Some aspects of the bill are positive, such as requiring organizations to take various measures when a data breach occurs. Even the current government has some transparency problems in this regard. The third aspect seeks to create offences in relation to the contravention of certain obligations respecting breaches of security safeguards. The fourth aspect would allow the the Privacy Commissioner, in certain circumstances, to enter into a compliance agreement with an organization.

Those are the four main aspects of Bill S-4 that raise concerns. Other aspects of the bill are positive and constitute a step in the right direction. That is why I support the motion to send Bill S-4 to committee to resolve the problems it contains that could result in a breach of privacy.

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, it is important that we move the bill forward as quickly as we can so that we can put in place the laws that will protect Canadians' private information in the digital world. I think that is a key to being able to move the bill.

Certainly we are supporting the process of Bill S-4 coming forward. The Senate has put forth a good bill in this particular case. From listening to the debate here this afternoon and knowing that the opposition members are clearly on side with this type of legislation, I look forward to their questions and concerns as we move forward.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I hope I will not put my hon. colleague from Brandon—Souris on the spot to ask a question that relates to what the government House leader has done here. I do not have decades of parliamentary experience, but it is certainly unusual to have a bill from the Senate brought here to be sent to committee. This is a parliamentary procedure that I have not encountered before.

I am very curious as to why we are going through this unusual S. O. 73 approach, as opposed to the normal second reading that is followed by the bill going to committee. I wonder if he can enlighten me as to the procedural manoeuvring that we see for Bill S-4.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would remind the House that we are debating a motion to refer Bill S-4 to committee before it passes second reading.

The member who just spoke talked about all the good aspects of Bill S-4, and yet he voted against my Bill C-475, which proposed more or less the same things, if not better protections for Canadians.

However, my question is more about the Supreme Court decision regarding a provision of this bill related to personal data. We do not know whether the Conservatives plan to change this provision during the study in committee.

Is the member who just spoke afraid that this bill will be considered unconstitutional? If not, why does he not want to consider the Supreme Court's decision in the Spencer case in relation to this bill?

[Larry Maguire, Conservative, Brandon—Souris, MB]

Mr. Speaker, I am pleased to rise today and speak in support of Bill S-4, the digital privacy act.

Last April the Minister of Industry announced Digital Canada 150, an ambitious plan for Canadians to take full advantage of the opportunities of the digital age. It is a plan that sets clear goals for a connected and competitive Canada in time for our 150th birthday in 2017.

One of the five pillars of Digital Canada 150 is protecting Canadians. Our government understands that in order for Canadians to take advantage of opportunities in the digital age, we must protect Canadians' private information in the digital world.

Previously our government has taken action to protect Canadians by introducing Canada's cyber security strategy and Canada's new anti-spam law. Bill S-4 adds to our record of standing up for Canadians in the online world.

This bill introduces measures to update PIPEDA, the Personal Information Protection and Electronic Documents Act, by setting out specific rules that businesses and organizations would have to follow whenever personal information was lost or stolen.

I was pleased to see that the member for Terrebonne—Blainville supports this bill and I am looking forward to her support when the bill comes to a vote in the House. In fact, the member said about the bill, “We have been pushing for these measures and I'm happy to see them introduced.”

Data breaches continue to be a major challenge to the privacy and security of citizens around the world. For example, this past summer JPMorgan Chase & Co., one of the largest banks in the U.S., was the victim of an attack that affected the accounts of 76 million households and seven million small businesses. Home Depot recently confirmed that 56 million payment cards were impacted in a breach of its payment card systems that lasted for five months.

Worldwide, there were between 575 million and 822 million data breaches in 2013. In the U.S. alone, nearly 92 million records were compromised in 2013.

Currently PIPEDA contains no obligations for businesses or organizations to tell customers when their personal information has been lost or stolen. I am pleased to tell the House that Bill S-4 introduces measures to address this issue. The bill creates new requirements under PIPEDA for reporting losses, theft, or other unauthorized access to personal information that may result from accidental or malicious activity.

These provisions would ensure that Canadians can take action to protect their personal information in the event of a privacy breach, while also encouraging businesses to adopt better information security practices. Organizations that deliberately ignored these requirements would face penalties of up to $100,000 per offence.

Let me explain how the new provisions will work.

Under Bill S-4, an organization that suffers a privacy breach would be required to notify affected individuals if there is a risk of significant harm. The organization would also have to report the breach to the Privacy Commissioner of Canada.

In fact, the interim Privacy Commissioner, Chantal Bernier, said that this bill contains “...very positive developments for the privacy rights of Canadians”. She was pleased that the government had addressed issues such as breach notifications.

The bill identifies the factors an organization would have to consider when determining whether or not there was a real risk that some form of significant harm would occur as a result of a privacy breach.

First, the organization would have to consider the sensitivity of the personal information. Second, the organization would have to consider the probability that the stolen information would be misused—for example, whether the data was encrypted, how much time had passed between the occurrence of the breach and its detection, and whether the cause of the breach was a malicious attack or was accidental.

Let me say again that by law, an organization would be required to notify individuals as soon as a breach was confirmed. If an organization determined there had been a breach, it would also have to notify other organizations in order to reduce the potential risk for the individual whose information was compromised. For example, if a store experienced a breach of its customer records, it would have to notify the relevant credit card companies or financial institutions.

Let me draw the attention of the House to a key element of these data breach requirements, which is that the bill would require organizations to keep records of all data breaches and provide this information to the Privacy Commissioner upon request. This would give the commissioner the ability to oversee data breach reporting and notification requirements. The Privacy Commissioner would be able to request these data breach records at any time. There would be no need for him to be conducting an audit or investigation when he requests them.

Bill S-4 includes heavy fines for companies that knowingly contravene these new requirements. Companies that deliberately failed to report a data breach to the commissioner or failed to notify individuals would face fines of up to $800,000. This could be up to $100,000 for every individual not told. Similarly, companies that deliberately cover up a data breach by not keeping these records or by destroying them could also face fines of up to $100,000.

Some might ask why there is a need for penalties related to data breach notification, given that most organizations comply with the Privacy Commissioner's guidelines for voluntary notification already. The government recognizes that many organizations already notify individuals of data breaches in a responsible manner; however, some do not. These penalties would target the bad apples, those organizations that willfully and knowingly disregard their obligations or, worse, cover up a breach.

Canadians know that our government takes their privacy concerns very seriously. I look forward to the continuation of this debate as we work with the opposition on how we can best protect Canadians in our digital world.

[Marie-Claude Morin, NDP, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, I thank my colleague from Saanich—Gulf Islands for her very specific information.

I think it is a waste of our time to talk about where it is written or how this is good and so on. Canadians' rights and privacy are being threatened. That is what we need to be looking at. We need to work together on Bill S-4.

That is why we want to refer it to committee.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, in response to the question from my hon. friend from Kootenay—Columbia, perhaps my hon. colleague from the official opposition would find it helpful to refer to the opinion of Michael Geist, who is an expert in this area of law, cited with approval by the minister in Debates just before we broke. He has said that the Supreme Court of Canada decision on Spencer is directly on point and that the Supreme Court rejected the view advanced by government ministers. The government argued in committee that:

In the instance of PIPEDA, because of the type of information provided in a pre-warrant phase, such as basic subscriber information, it would be consistent with privacy expectations and therefore it's not really putting telecoms, for example, in some unique position in terms of police investigations.

Professor Geist went on to say that the Supreme Court of Canada rejected this view in terms of Spencer, concluding that “there is a reasonable expectation of privacy in the subscriber information”. Therefore, there is a very clear link between the reasoning of the Spencer decision and the bill before us, Bill S-4.

[Marie-Claude Morin, NDP, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, I am pleased to rise today to speak to the motion to refer Bill S-4, the Digital Privacy Act, to a committee before second reading. I would also like to take this opportunity to congratulate my colleague from Terrebonne—Blainville, who has done such an outstanding job on this file.

Bill S-4 has a number of shortcomings and must be amended, which is why we would like to send this bill to committee before second reading.

I will give some details about the bill in order to put it in context. Bill S-4 amends the Personal Information Protection and Electronic Documents Act to compel private sector organizations to disclose any loss or breach of personal information. So far, so good. It also sets out sanctions to be imposed on organizations that fail to comply with that obligation. Again, so far, so good.

However, the proposed criterion for mandatory reporting is subjective, because it allows organizations to determine themselves whether it is:

...reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual.

In my opinion, this major flaw in the bill needs to be corrected. Why make laws if we are going to ask the organizations to enforce them themselves? I have my doubts. That is like giving a minister full power. That does not work either.

Bill S-4 would also give the Privacy Commissioner new powers to enter into compliance agreements with organizations that, according to the Commissioner, have failed to respect the provisions in the legislation, leaving the personal information of Canadians vulnerable. So far, so good.

Bill S-4 adds exceptions under which personal information may be collected, used or disclosed without an individual’s consent. The bill would make it easier for organizations to share personal information with each other without the consent of individuals, if the organizations are engaged in a process leading to a prospective business transaction.

The NDP absolutely disagrees with this type of provision. It is really not good for consumers. People will receive more advertising and unsolicited communications. We do not really need that in our consumerist society.

In other words, the bill allows an organization to disclose private client information under certain circumstances. If a company has my private information, for example, it can share it with another company, which can then do whatever it wants with that information. The next thing I know, I am receiving ads, or other unwanted things, at home. I do not think that is right. That is a very significant flaw in the bill.

Bill S-4 also amends provisions in the law that define the situations in which a person whose private information has been lost or compromised by a security breach can apply to the Federal Court for a hearing after receiving the Commissioner’s report or having been informed of the end of the complaint investigation. The bill extends the timeframe from 45 days to one year for a complainant to make an application to the court. I have to admit, that is a useful provision because it gives people more time to figure things out. It gives them a chance to analyze the situation and make a decision about whether to go or not go to court.

Bill S-4 also requires organizations to maintain a record of all breaches of security safeguards involving personal information under their control. This record could eventually be audited by the Office of the Privacy Commissioner of Canada. Again, I see some small flaws that open the door to subjectivity. I am not convinced of the merits of this provision.

My party and I are extremely concerned about the fact that Bill S-4 contains a provision that allows organizations to more easily share personal information without a warrant, without the consent of the clients and without an appropriate oversight mechanism. That is very worrisome and should be amended right away.

Given a recent Supreme Court of Canada decision, this provision will very likely be deemed unconstitutional. It is therefore important that the government comply with the Supreme Court's decision and remove from the bill all clauses relating to the warrantless disclosure of personal information.

The government has a very poor track record when it comes to protecting personal information. Although Bill S-4 contains some good provisions, it will not erase the past. The bill must therefore be amended so that it really meets the needs of Canadians and complies with international privacy standards.

In just one year, under this Prime Minister's government, government organizations secretly made over 1.2 million requests to telecommunications companies for personal information without a warrant and without proper oversight. I think that is all I need to say for people to understand that this is a concern. The government should have taken advantage of the opportunity afforded by Bill S-4 to correct the flaws that led to many violations of Canadians' privacy.

Finally, because of the government's inaction, the law has not been updated since the introduction of the new generation of iPods, iPads, iPhones and the like. We have fallen far behind in terms of international standards. Bill S-4 therefore does not go far enough and does not make the proper amendments to adequately protect Canadians in today's digital age.

There is still much to be done to adequately protect the privacy of Canadians. The government would do well to take this issue seriously.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I heard several of the Conservative members' speeches. They gave 10-minute speeches on Bill S-4. That is nice, but we are debating a motion to refer it to committee before second reading. I did not hear a single member explain why that would be necessary.

My New Democratic and Liberal colleagues said that they hope to be able to fix some of the legislative problems with the bill before us. The Conservatives want us to send it to committee, but they do not seem to be acknowledging that their bill is problematic.

Can the member tell Canadians why the government is using an unusual measure to send this bill to committee? So far, the Conservative government has not explained its intentions at all.

[Joan Crockatt, Conservative, Calgary Centre, AB]

Mr. Speaker, I am very pleased to rise today in strong support of Bill S-4, the digital privacy act. I am also pleased to be able to tell Canadians young and old, as well as businesses, exactly what this bill would do for them.

Bill S-4 would provide important updates to our private sector privacy law, called the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA. This bill is all about keeping our laws up to date in the rapidly burgeoning digital economy.

The biggest thrust in the protection of Canadians' online privacy, which we eagerly and sometimes maybe too eagerly jump to use, as this is a place where we go to surf, shop, and sell things, is to improve the protection of people's privacy. Our government understands that for a strong digital economy to work and for people to feel confident using this technology, they have to know that they are receiving those protections.

We have consulted very widely with business, with consumer advocates, and with a lot of real people, like moms and dads, to come up with this bill. Our consultations have shown one thing that is very clear, which is that people value their privacy. It is very important to Canadians. As a country, we regard it as a fundamental right, and we expect our personal information to have certain protections. All of us want to be able to embrace this great opportunity that is the web, and we want to have trust and confidence that our information will be protected when we are out there swiping our credit cards, punching in our PIN and pass codes, and giving out our names and addresses at stores and other places where we do businesses. Really, we are putting the details of our personal lives out there in the hands of businesses and other organizations.

Earlier this year, our government launched Digital Canada 150. This was an ambitious plan to give Canadians confidence that they can take advantage of the full opportunities of the digital age. One of the main pillars of Digital Canada 150 is protecting Canadians, and that is where Bill S-4, which we are talking about today, comes in. It would take what is already one of the world's best privacy regimes and make it even better.

The digital privacy act has five key areas, and I would like to touch on each one and explain for my hon. colleagues why each one is necessary.

The first area is mandatory notification if there are data breaches. These are requirements for companies to let us know if our personal information has been lost and there is a potential to expose us to harm. The time frame companies would be given to do this under this bill would be as soon as was feasible. For example, if a company's computer system was hacked and the clients' credit card information was stolen, the company might need a week to put a fence around it and figure out how many people had been affected and let us, as consumers, know. If the data breach or the hacker was more sophisticated, it might take the company a couple of weeks to figure out everyone who was affected and let us know. There would be some flexibility, but one thing that would be very clear would be that companies could not delay notifying us when there was this kind of breach.

If a company was hacked and it failed to notify clients in the shortest time frame possible, it could be taken to court by the Privacy Commissioner or by individuals. In addition, if a company willfully covered up a data or privacy breach, it could be charged up to $100,000 for every client that had not been notified. We see that these are very significant penalties. Recent revelations that large everyday retailers we deal with, such as Target and Home Depot, were victims of cyberattacks underscores the need for this legislation.

Also, the Privacy Commissioner would have to be notified, so if an organization deliberately covered up a privacy breach or intentionally failed to notify individuals or the Privacy Commissioner, again it could face significant fines.

The second set of changes in Bill S-4 deals with the rules around vulnerable individuals, especially kids.

The government examined this issue very closely as well and talked with experts and other interested parties. Based on this, it put new measures in the digital privacy act that would make it very clear that to give valid consent for information to be collected online, a person's age would have to be taken into account. For example, if one had a website specifically targeted at children and wanted to collect information, one would need to put in something like a pop-up that would say, “before filling in this information, go get your mom and dad”. Children's interests would now be put forward, and that would have to be done using very simple language.

These measures would put more power in the hands of consumers and would keep them better informed when they were out there doing business involving the worldwide web. They would also encourage businesses to adopt better privacy practices.

At the same time as we would be adding new privacy protections, we would also be removing some red tape. The third set of changes would ensure that businesses could collect data they needed to do legitimate business things. I want to stress that these changes would be limited and very much common sense. For instance, believe it or not, right now businesses are breaking the law if they give their own employees' email addresses to customers and clients without the employees' permission. Things like that just do not make sense.

These amendments would let businesses use personal information produced at work; disclose information, such as employees' salaries, that might be important if one were buying or selling a business; use information that might be contained in a witness statement to process an insurance claim; and keep information that is necessary in a regular employee-employer relationship. Businesses would be able to use this information to support normal day-to-day business activities, but, and there is a big but, they would still have to make sure that the privacy of that information was protected and not compromised. If they did not play by the rules, companies could be named and shamed and taken to court and fined.

The fourth group of amendments would allow certain information to be shared without necessarily first allowing for a person's consent if it was shown to be in the public interest or in that person's interest to do so. It would harmonize federal law with Quebec law, Alberta law, and British Columbia's private sector data protection acts.

One might ask what kind of instance that would be. For example, it would protect seniors from financial abuse if a bank noticed that there was some untoward activity going on in their accounts. It would allow emergency, police, or medical officials to communicate with a person's family if the person were injured or deceased.

Who would enforce all of this?

PIPEDA is enforced by the Privacy Commissioner of Canada, who acts like an ombudsman and who would get stronger tools in this legislation. The Privacy Commissioner could turn a matter over to the Federal Court if an organization were breaking the rules, and the court could levy fines and order the company to clean up its act. As well, citizens could personally take companies to Federal Court to order them to change their practices or could ask the court to award personal damages.

The bill would also boost the time available for a complaint if one was going to take an organization to court. It used to be 45 days, but under this proposed legislation, it would grow to a year.

Finally, the digital privacy act would create a new tool that would be an alternative to court action. The Privacy Commissioner could negotiate a binding deal with a company to make significant changes to comply with the legislation in exchange for not being taken to court.

This is all about confidence. It is about the consumer having confidence when having their personal information used so that they can do trade and commerce. They can surf the web. They can buy and sell with confidence and know that they and their families are safe online.

Bill S-4 would provide the necessary updates we need to privacy laws to protect consumers. It is a major part of our government's digital economic strategy, Digital Canada 150, and I urge all hon. members in this House to join with me and support this important piece of legislation.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I would just like to note, parenthetically, that I disagree with my hon. colleague from Winnipeg North about whether we got the right balance on cyberbullying in Bill C-13.

However, let me get back to Bill S-4. Is it not just a question, more than whether this is a warrantless act or semantics, whether Bill S-4 would withstand a Supreme Court challenge in light of the Spencer decision? I would ask my hon. colleague for his comments.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I listened to my Liberal colleague's speech with great interest. He seems to be very concerned about protecting Canadians' personal information. That is something we should all be concerned about.

However, when it came time to vote, the Liberal Party supported Bill C-13. I am perplexed. They seem to be saying one thing but voting another. Can the member clarify whether the Liberals plan to support Bill S-4? They are saying one thing now, but will they change their minds when it is time to vote?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, it is with pleasure that I rise to speak to Bill S-4 this afternoon.

It is an important piece of legislation, as it at least attempts to deal with an issue that many Canadians are quite concerned about. They see the merit of the government introducing legislation on how Canadians can be protected. However, there is also a great deal of concern about the manner in which the Conservative government, as it has in the past, appears to be attempting to overstep concerns related to privacy and protecting the privacy of Canadians.

We have before us Bill S-4 this afternoon. It attempts to deal with and expand warrantless access to subscribers' data. This is an issue which can no doubt be exceptionally controversial. It is something that needs to have more consultation and work with the different stakeholders so that we do not make mistakes.

As suggested in the bill's title, this bill has come from the Senate. There were concerns upon its departure from the Senate and entry into the House regarding the constitutionality of the legislation. I have found that quite often the government will bring legislation into the House in anticipation that it will ultimately pass, yet a great deal of concern has been expressed regarding the degree to which it would be in compliance with Canada's Constitution, the Charter of Rights, and so forth.

Time and time again, I have heard it suggested, and I have suggested it myself, that the government needs to be more forthright in providing information which clearly shows that the legislation it is bringing forward would pass our laws. More often than not, we do not receive the legal opinions from the department giving clear indication that the legislation being debated is in fact constitutional and will pass the Supreme Court. That is important to note, for the simple reason that when the House of Commons passes legislation and it gets challenged, it costs literally millions of dollars, especially if the government has done it wrong.

The idea of seeing Bill S-4 go to the committee is something we are quite comfortable with. Going through the summary of the bill gives us the sense of the scope we are dealing with. The act would amend the Personal Information Protection and Electronic Documents Act to do a litany of things. It covers quite a broad area. We have expressed a great deal of concern about some of it to the Liberal Party critic.

The primary concern we have is ensuring that the privacy of Canadians is being respected. Checks need to be put into place to ensure that there is accountability.

Let me give members a couple of very specific examples of what the legislation is proposing. This comes from the summary of the bill itself. It would “permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of...”

Here it lists some very specific things. These are:

(i) identifying an injured, ill or deceased individual and communicating with their next of kin,

(ii) preventing, detecting or suppressing fraud, or

(iii) protecting victims of financial abuse;

As I said, there are a litany of things. One that really caught my eye and that I think is a very strong positive is related to the Privacy Commissioner. The bill says, “modify the information that the Privacy Commissioner may make it public if he or she considers that it is in the public interest to do so”.

We have seen an expansion of the role, if I can put it that way, of the Privacy Commissioner, and giving more authority to him or her. Through the legislation, we are also seeing more penalties being brought in.

This is not only the first but the second piece of legislation over the last number of months dealing with privacy. It was not that long ago that I was speaking to Bill C-13, the protecting Canadians from online crime act. It deals with cyberbullying. Canadians have little tolerance for cyberbullying and the types of things that take place.

Bill C-13 focuses a great deal of attention on the distribution of pictures without consent onto the Internet. We had some difficulty with Bill C-13, as we do with Bill S-4, but we ultimately ended up supporting the legislation because we recognized how important it was to stop cyberbullying. There were concerns with that legislation just like there are concerns with this particular piece of legislation.

We would like the government to provide more answers and be a bit more transparent about what it hopes to achieve with this legislation. We call upon the government to do just that in anticipation of the bill going to committee where it will be changed in order to provide some comfort to Canadians with respect to their privacy. Privacy is an issue that the Liberal Party takes seriously. Our party critic has had the opportunity to express many of our concerns with regard to it.

Bill S-4 would allow for warrantless requests of companies. Telecom companies and service providers could be approached in order to access personal information.

Over the last decade we have seen an explosion of technology in the computer and Internet areas. Who would have thought 15 or 20 years ago that we would be where we are today? In many ways we are playing catch-up in terms of trying to bring forward legislation in order to protect Canadians. Canadians have great access to the Internet as a whole. Many things are done through the Internet and unfortunately, at times, people are exploited, so we need bills such as Bill S-4 to deal with that.

Today we are talking about corporations getting personal information about people living in Canada who ultimately go to a particular telecom provider. That means company x could request specific information from a telecom provider about a particular customer who is being serviced by that provider. All of us should be concerned about that. All of us should want to do what we can to ensure that the privacy of Canadians is respected and that there are checks in place to ensure no abuse is taking place.

What we are talking about are warrantless requests. People would be surprised to know that in 2011, almost 800,000 warrantless requests by telecom companies were documented. People would be amazed to know the amount of information that leaves Canada through the Internet via, for example, the United States and ultimately comes back into Canada. The U.S. national security agency no doubt has access to a lot of Canadians' personal information.

At the end of the day, the bottom line is that the government has a responsibility to provide assurances to Canadians that their right to privacy is being protected. This is the greatest concern I have as the bill continues to go forward.

The challenge is to ask the government to provide the necessary amendments that would protect and provide assurances to Canadians that their privacy would in fact be protected. I am very concerned that private corporations, on a whim, could say a copyright has been infringed, or there is a perceived illegal activity and then are able to get personal information on Canadians.

[Craig Scott, NDP, Toronto—Danforth, ON]

Mr. Speaker, it is my pleasure to address this motion by the government to have Bill S-4 go to committee before second reading, which is a rare event in the House. This is a procedure that was made possible for the first time in 1994 amendments. I believe it stemmed from the 1982 McGrath committee's report that said that committees should more often be used at the early stages of legislation to make sure that things are caught and that a wide variety of perspectives are taken into account in drafting legislation and, frankly, to make the role of MPs more meaningful than is often the case when a bill is studied only after second reading in committee.

As we know, in committee after second reading, and after hearing any amount of testimony from witnesses that could suggest serious problems with a bill, the amendments are often extremely constrained by the rule that they must fit within the principle of the bill. Quite often that means that the principle is understood by the chair or the legal staff advising the chair as simply the principle of a given provision, and therefore, an attempt to work more broadly than the narrow purpose of a given provision is often ruled out of order.

Beyond that, I have found so far in committees, since arriving in the House, that there seems be a reluctance at the moment, on the part of the advisers to chairs, to understand that bills can often have multiple purposes and not just a single purpose. Therefore, in the end, after second reading, committee work often really is an exercise in frustration, because a lot could be done to perfect a bill that is technically ruled out of order due to the fact that we have to work within the principle of the bill as voted at second reading.

It is great that this bill is going to committee before second reading. It will hopefully allow, in the spirit of what this procedure is all about, a full, frank hearing, from all kinds of witnesses, about the problems I hope the government understands are in this bill. I hope this is also the reason the minister has decided to send it to committee before second reading. There can be true dialogue and engagement among MPs, obviously with the government watching what is going on and giving its input through government MPs, so that this bill is taken apart and rewritten in the way this procedure would allow.

I myself stood in the House to move unanimous consent to have Bill C-23, what New Democrats called the unfair elections act and the government called the fair elections act, referred to committee before second reading, exactly for the reasons I have just given. There were so many obvious problems in the bill. Not sticking to the principle in the bill and working collegially across party lines would have benefited the study of that bill. In retrospect, New Democrats realize how true that was. Although we got serious amendments passed, with pressure from backbench members of the government suggesting changes that helped us in our efforts, that bill would be much better if it had gone to committee before second reading.

There is another procedure that, in the spirit of openness, I am hoping the minister might consider. To date, it has not been the practice of the government to table opinions about the constitutionality or charter compliance of a bill. Given the real concerns that exist with respect to warrantless access to information that is contained in this bill as kind of a compendium bill to Bill C-13, I would ask the minister to please consider, for once, having the Department of Justice table a written opinion on the constitutionality of this. Why does it think that the Spencer judgment coming out of the Supreme Court of Canada does not apply or, if it applies, that the bill is written in a way that justifies it under the charter?

So often in committee there is minimal to no good testimony from the civil service side on why, supposedly, the Minister of Justice has certified that a bill is in compliance with the charter. We know that the standard for the minister doing that is a very minimalist standard.

I will read from the Senate testimony on Bill S-4 from Michael Geist, of the University of Ottawa, to tell the House why having that additional procedure as part of the referral to committee before second reading would be useful. He says:

Unpack the legalese and you find that organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. This applies both [to] past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person (who therefore cannot challenge the disclosure since they are not aware it is happening).

That is an extremely good summary of a core problem with the bill in terms of the fears it raises that it has gone too far. It would purportedly create an updated regime to protect privacy and in the process would potentially ram through new problems with respect to Canadians' privacy.

I would like to now, in my last couple of minutes, go over a few points that I hope come up in committee.

I wish to thank a constituent, Mr. John Wunderlich, an expert in privacy law, who worked with me on the weekend to better understand the bill. These are points that I hope do have discussed.

In paragraph 4(1)(b) of the act, the definition of who this would apply to would move from just employees to employees and applicants for employment. In that context, this leaves hanging the question of how much or how little this would apply to companies whose business is to conduct background checks. The committee should solicit feedback on this. In my view, the background check function in the employment sector is done far too often and too deeply and already constitutes a systemic privacy invasion in the employment sector. Therefore, this extension needs to be looked at.

The next thing is the definition of valid consent. While it is welcome, because it brings clarity, the committee should note whether the current systems asserting consent on the web actually provide meaningful information to web surfers about just how many entities will be given access to either some or all of their personal information. Right now, there is a real risk that so-called valid consent, as outlined in the bill, would actually piggyback on the systematic sharing of information that people have no idea is being shared. The act could become a smokescreen behind which individual profiles were built and shared across businesses.

I have already spoken about the potential for the warrantless invasion of privacy because of the fact that organizations could seek information from others when they are simply investigating breaches of agreement or fraud. We should keep in mind that when they are investigating fraud, it is not just in the criminal context. All of this involves civil questions as well. An example is fraudulent misrepresentation.

The “real risk of significant harm” test for companies in particular to decide whether they are going to inform the commissioner and at another stage inform persons of breaches of privacy is a problematic standard in the sense that it is actually very general, and it is probably too low. There should be a presumption for disclosure to the commissioner, and it should be left up to the commissioner to either determine, or assist the company in determining, whether this is significant enough to let the persons whose information was released know that it happened. At the moment, it is an entirely discretionary system, based on a very vague standard, which may mean that data will be breached without people actually knowing it and being able to take the measures necessary to protect themselves.

Those are only three of the more specific concerns that need to be looked at. There is a lot in the bill.

I have a final comment, and it may be a rather strange one. I am looking at my colleague across the way. The privacy legislation from Alberta should be looked at very closely as a reference point for whether the government has gotten certain things wrong. That province has gotten things right.

[Joyce Bateman, Conservative, Winnipeg South Centre, MB]

Mr. Speaker, today it is my absolute pleasure to express my support for Bill S-4, the digital privacy act. When the industry minister released Digital Canada 150, our government's plan to guide Canada's digital future, he set out clear goals to put our country at the forefront of the digital economy.

One of the five pillars of this ambitious plan is “protecting Canadians”. In order to realize the full benefits of the digital plan and the digital world, Canadians must have confidence that their online activities are secure and that their online privacy is protected through strong measures like the digital privacy act.

This government is taking concrete action to make sure that Canadians and their families are protected from online threats. Protecting Canadians online is particularly important when we consider the most vulnerable segments of our society. Indeed, as the Internet becomes present in virtually every aspect of our economy, and our children's homework, it is also becoming an essential element in our children's lives.

A recently released survey conducted last year by MediaSmarts, a charitable organization dedicated to digital and media literacy, revealed that in 2013, 99% of Canadian students were able to access the Internet outside of their school. When online, students play games, download music, television shows and movies, and socialize with their friends and family.

The survey reveals that over 30% of students in grades 4 to 6 have Facebook accounts, and that by grade 11, my daughter's year, 95% of students have an account. However, with this increased online presence comes increased risk. As we have seen, young people can unfortunately become targets of online intimidation and abuse. This government has acted to protect our children from cyberbullying and other similar threats.

In addition to responding to the very real and harmful threats related to cyberbullying, this government is also acting to protect the privacy of minors and other vulnerable individuals through proposed amendments to the digital privacy act.

In our modern digital economy, our children must be able to go online in a safe and secure way if they are to develop the skills they will need later to find jobs in the digital marketplace. The online world has the potential to provide considerable benefits for our children's education and development, and it can greatly enrich their social lives.

At the same time, going online can expose children to privacy risks. For example, minors can be subject to aggressive behavioural marketing tactics, or they could have their personal data collected and shared without truly understanding what is being done. There is the potential for long-term privacy consequences.

The digital privacy act includes an amendment to Canada's private sector privacy law to strengthen the requirements around the collection, use, and disclosure of personal information, which will increase the level of protection for vulnerable Canadians such as children. Specifically, the digital privacy act clarifies that when a company is seeking permission to collect, use, or disclose personal information from a specific group of individuals such as children, then the company must make sure that an average person, such as a child in that group, would be able to understand what is going to happen with the information.

An example is the best way to illustrate how the proposed amendment will work. Imagine, for example, an educational website that is designed primarily for elementary school children. Under the proposed amendment, any request by that website to collect, use, or disclose personal information would need to be worded in such a way that it is understandable by the average elementary school student. This not only includes making sure that the wording and language used in the request is age appropriate, but that the request itself is appropriate as well. If it is not reasonable to expect that the average elementary-aged child would understand the purpose and consequences of them clicking “okay”, then under the digital privacy act the company would not have valid consent.

Minors under the age of majority are more vulnerable and require additional protections. At the same time, privacy protection for children must reflect their level of maturity and psychological development. It must respect that.

That is why our government has ensured that the flexibility inherent to the act which allows the application of contextual privacy protections is reflected in our proposed amendment. The ability of teenagers to understand what is being done with personal information and their ability to make decisions about what they will and will not agree to is completely different from what elementary school children are capable of.

As they age, minors become more able to make sound decisions about themselves and what is being done with their personal information. Therefore, a website directed, for example, to grade 12 students, should not explain what it intends to do with information and seek consent in the same way that an educational website for elementary school students would. The process is similar; the means are different.

The proposed amendment adjusts for this difference by focusing on what is reasonable to expect of the group of individuals being targeted by the company's product or service.

The former interim privacy commissioner strongly supported this proposed amendment when speaking to the Senate committee that was studying the bill last spring. This is what the Office of the Privacy Commissioner said in its written submission to that committee:

We think this is an important and valuable amendment that will clarify PIPEDA’s consent requirements. By requiring organizations to make a greater effort to explain why they are collecting personal information and how it will be used, this proposed amendment should help make consent more meaningful for all individuals, particularly for young people for whom the digital world is an integral part of their daily lives.

As an added protection, PIPEDA has always recognized that parents or other authorized representatives have the right to provide consent on behalf of an individual, including children. Indeed, the responsibility and commitment to protect the privacy of children and other vulnerable Canadians is absolutely a shared one. Parents, governments, educators, as well as charities in the private sector, all have a central role to play in protecting the online privacy of our children.

The government firmly believes that digital literacy and skills are at the core of what is needed for individuals to succeed in today's online economy. Understanding by parents, educators, and children of the relevance and importance of protecting online privacy is a central component of digital literacy.

The government supports the role that the Office of the Privacy Commissioner of Canada is playing in educating Canada's youth about the importance of online privacy and helping them to not only understand the impact that online services and applications can have on their privacy but also helping them make wise, smart decisions.

For example, the office of the commissioner created a graphic novel called Social Smarts: Privacy, the Internet and You. It was designed to help young Canadians better understand online privacy issues. They have also created tools to support parents and educators as they seek to protect children's online privacy. A discussion guide and privacy activity sheets have been developed to help them work with children to explore and understand privacy risks associated with social networking, mobile devices, texting, and online gaming.

The government is committed to protecting the privacy of Canadians. The digital privacy act takes concrete action to protect the most vulnerable members of our society, and that includes our children. At the same time, this legislation respects the growth of our children as they approach adulthood. It is measured and graduated because of that.

I hope all hon. members will join me in supporting this very important bill.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I have another question for my colleague.

The government's bill is called the Digital Privacy Act. However, we now know that the Conservative government does not have the best record in the world when it comes to protecting privacy. It lost track of a significant amount of Canadians' personal information. It passed Bill C-13, which gives statutory immunity to Internet service providers who decide to voluntarily hand over personal information. There is no shortage of examples: government agencies made at least 1.2 million requests to Internet service providers in just one year.

Does the hon. member not have any misgivings about this? Will the government really make good changes during the review of this bill in committee?

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I am happy to rise in the House today to speak to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act. As members know, today's debate turns not precisely on Bill S-4 but on a motion to refer the bill to committee before second reading.

The concerns that I will raise with respect to the bill itself, which go as far as to challenge the constitutionality of the bill, would likely be fatal to the bill at second reading, but we need not concern ourselves with that today. We need not arrive at a conclusion about how fatal these flaws are or how injurious they are to the bill.

The motion before us today would allow us to visit the scope and principle of the bill at committee and make, as required, amendments to those very principles and scope of the bill.

Today, I would argue that this motion warrants support, so that we have the flexibility to properly study, examine and propose amendments to the bill at committee before the principle and scope are set.

Let me set out a few reasons why this is particularly important in these circumstances and relating to this particular legislation.

First, let me address the issue of public opinion that sets the context in which this bill and more broadly the issue of privacy concerns exist.

According to a survey of Canadians on issues related to privacy protection conducted last year, 70% of Canadians feel less protected than they did 10 years ago; only 13% of Canadians believe that companies take their privacy seriously; 97% of Canadians say they would like organizations to let them know when breaches of personal information actually occur; 80% of Canadians say they would like the stiffest possible penalties to protect their personal information; and 91% of Canadian respondents were very or extremely concerned about the protection of privacy.

The current government cannot absolve itself from contributing to this level of public concern about privacy issues. It is not just a matter of legislative lethargy; that is, it is not just about the fact that we are well past the five year mark for the conduct of a mandatory review of the Personal Information Protection and Electronic Documents Act, an act that is by now well behind international standards and has failed to keep up with technological advancements in this digital age.

Part of the issue here is that the current government has itself repeatedly demonstrated insufficient care for the personal privacy of Canadians through its own conduct. I would point to the fact that in one year alone, under the current Prime Minister's watch, government agencies secretly made more than 1.2 million requests to telecommunications companies for personal information, without warrant or proper oversight.

It is a government with a seemingly insatiable appetite and perhaps an addiction to Canadians' personal information. It is a government that needs to be constrained by effective legislation that protects the privacy and personal information of Canadians. It is a government that has no credibility on this subject matter.

This is evident in the legislation that the Conservatives have defeated in this House. In 2012, our NDP digital issues critic, my colleague from Terrebonne—Blainville, put forward Bill C-475, a bill to amend the Personal Information Protection and Electronic Documents Act. It would have applied similar online data protection standards that exist in Quebec's personal information protection act. For example, Bill C-475 would have given the Office of the Privacy Commissioner of Canada the power to issue orders following an investigation. The Conservatives defeated that bill at second reading. They also defeated our NDP opposition day motion on May 5 last year. That motion simply called on the government to close loopholes in existing legislation that currently allowed the sharing of personal information without warrant.

The current government's disregard for private and personal information is also evident by the legislation that it has brought forward.

Bill C-13, the government's cyberbullying law, includes lawful access provisions that would expand warrantless disclosure of information to law enforcement by giving immunity from any liability for companies that hold the information of Canadians to disclose it without a warrant. This makes it more likely that companies would hand over information without a warrant as there are no risks that they would face criminal or civil penalties for such conduct.

There is a thread here that runs through the government's own efforts to access the personal and private information of Canadians through to their conduct and voting record in this place. It goes against the interests and concerns of Canadians and denies the wishes of Canadians for greater protection of their personal and private information.

In other words, the issue before us goes to the principles underlying this bill. They need to be examined and amended at committee. For example, while Bill S-4 would make it mandatory to declare the loss or breach of personal information for the organizations in the private sector and penalize organizations that do not fulfill this obligation, the proposed criteria for mandatory disclosure remains subjective. It would allow the organizations themselves to assess whether “it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”.

More and most problematically still, Bill S-4 would add exceptions under which personal information may be collected, used or disclosed without an individual's consent. The bill would make it easier for organizations to share personal information with each other without the consent of individuals if the organizations are engaged in a process leading to a “prospective” business transaction. In other words, under certain circumstances, the bill allows personal information of one organization's clients to be shared with another organization without the consent or knowledge of those individuals.

Here we run into some significant problems with this bill. The amendments proposed contradict the very foundation of the act they seek to amend and serve to defeat what the Supreme Court called in R. v. Spencer the act's “general prohibition on the disclosure of personal information without consent”. As the Supreme Court said in that recent decision, “PIPEDA is a statute whose purpose is to increase the protection of personal information”.

The Supreme Court, in R. v. Spencer, got to the heart of the issue here, understanding what the government has failed to understand about the issue of informational privacy in the digital age. It is worth quoting at length here. It stated:

Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.

So, from subscriber information, the Supreme Court has connected that information through to search and seizure.

We have at least before us a major concern with the principles of this act, but seemingly too a bill that is simply unconstitutional. Leaving aside for the moment this latter issue, let me suggest by way of conclusion that if there is something in Bill S-4 that is salvageable, it can only be so if this bill moves to committee before this House sets in concrete the principles and scope of this bill, and limits the kinds of amendments that can arise out of committee post second reading.

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, the legislation would provide a tremendous amount of protection to consumers and to government to ensure that the right solutions and the right oversight are in place.

The digital privacy act would not force companies to hand over private information to the police, copyright trolls or anyone else. These new measures would place strict limits and tight restrictions on companies that lawfully share Canadians' private information for investigative purposes. Organization to organization information-sharing already exists in Alberta and British Columbia. These changes were recommended by the access to information and privacy committee in 2007 with the agreement of the Liberals and the NDP and these provisions are well entrenched in this new legislation.

[Jonathan Tremblay, NDP, Montmorency—Charlevoix—Haute-Côte-Nord, QC]

Mr. Speaker, Bill C-13 and Bill S-4 give access to personal information without a warrant or any oversight mechanism.

Why does the government want to allow snooping without a warrant by creating these deficiencies with no oversight to prevent abuses in the system?

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, I am pleased to rise today to speak to Bill S-4, the digital privacy act. I support the bill.

The purpose of the digital privacy act is to strengthen the rules for the safeguarding of Canadians' personal information when they shop online or surf the web. The digital privacy act would amend the Personal Information Protection and Electronic Documents Act, more commonly known as PIPEDA, which provides a legal framework for how personal information must be handled in the context of commercial activities.

Last April, our Conservative government introduced the Digital Canada 150, an ambitious plan for Canada to take full advantage of the digital economy as we plan to celebrate our 150th anniversary in 2017. Digital Canada 150 has five pillars and 39 new initiatives that will allow Canada to be a leading nation in the digital domain. One of the most important pillars in Digital Canada 150 is the “protecting Canadians” pillar, which is what we are talking about today. The digital privacy act would introduce new amendments and stronger rules to help protect Canadians' personal information.

As we live in an increasingly digital age, the need to protect our personal information becomes stronger. We use credit cards to purchase items online. We use the Internet to browse websites that may ask us for our personal information, and so on. Just last month, Home Depot was the victim of a massive data breach. The information of 56 million debit and credit cardholders was stolen.

It is surprising that, under the current law, it is not mandatory for companies to disclose to their clients that they have been the victims of hackers or if they have lost personal information. That means that if someone's credit card information was stolen, under current laws, that person may never know his or her information was compromised. It may be surprising to some, but it is not currently mandatory that companies inform their clients if their personal information has been lost or stolen.

Under the digital privacy act, however, if a company fails to notify its clients of a data breach where their information has been compromised, it can face a fine of up to $100,000 for every client it fails to notify. In addition, companies are now required to keep a record of all data breaches, and all documents must be handed over to the Privacy Commissioner upon his or her request.

The digital privacy act would also put in place new provisions that would allow the limited disclosure of personal information when it is in the public interest. One such example is the unfortunate reality of financial abuse. As it stands now, banks and other financial institutions are prevented from reporting suspected financial abuse to the proper authorities. The digital privacy act would give the exception to allow banks to alert law enforcement when they suspect that a senior is being financially abused.

The Canadian Bankers Association has endorsed these amendments. It said:

We were pleased to see that Bill S-4 includes amendments that would give banks and other organizations greater ability to assist their clients to avoid financial abuse.

As our society spends increasingly more time online and on the Internet, it is important that we have the proper safeguards in place for our children. Educational websites and virtual playgrounds are becoming more and more popular with young children. Sometimes, for marketing purposes, these websites will ask for the users' personal information. Under the digital privacy act, there is a clearer set of rules for when companies ask to collect personal information from a child. The request for information now must be written in a way that a child can understand. If the wording is too complicated for a child to understand, the consent is not valid.

The digital privacy act would also ensure that online privacy laws reflect the realities of business, such as allowing businesses to share employees' contact information and information necessary to manage an employment relationship. Businesses also need to be able to use the information employees produce at work as well as the information necessary to conduct due diligence during a business transaction such as a merger.

The digital privacy act also puts forward rules that align with provincial privacy laws. For organizations, it is important that consistent rules for the protection of personal information apply and that wherever they operate their businesses, their obligations would be the same. Consistent rules also provide individuals with confidence that wherever they conduct their business in Canada their information will benefit from the same level of protection. The bill before us takes steps to align our privacy rules with provincial laws.

The bill before us is a much needed update to privacy laws in Canada. It is a balanced approach that includes stronger rules to ensure companies are held to account, exceptions to allow for seniors to be protected from financial abuse, and new rules to ensure our children are protected online.

Now is the time for these measures to be passed into law through the passage of the Bill S-4. I hope hon. members will join me in supporting the digital privacy act.

[Jonathan Tremblay, NDP, Montmorency—Charlevoix—Haute-Côte-Nord, QC]

Mr. Speaker, the Conservatives have repeatedly shown how little respect they have for the Supreme Court of Canada. We have seen various examples of their contempt for our justice system.

Why do they not remove the parts of Bill S-4 that are likely to be considered unconstitutional in light of the Spencer decision?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Mr. Speaker, as the member of Parliament for Renfrew—Nipissing—Pembroke, it is a pleasure to rise in the House today to speak in support of Bill S-4, the digital privacy act. Bill S-4 is an essential part of Digital Canada 150, our Conservative government's plan to confirm our leadership in Canada in the digital age.

Bill S-4 proposes a number of important changes to the Personal Information Protection and Electronic Documents Act, PIPEDA, that will strengthen the protection of Canadians' privacy. The digital privacy act would also set new rules on how personal information is collected, used, and disclosed. Most importantly, this legislation requires organizations to tell Canadians if their personal information has been compromised. Companies who fail to inform Canadians about privacy breaches would be subject to severe fines for breaking the rules.

The digital privacy act is a balanced approach that protects Canadians' personal information. It allows for information sharing when the law has been broken. This balanced approach confirms our Conservative government's respect for personal privacy.

Let us now address any misunderstanding by individuals who have not read our legislation, particularly when things are read into this bill that clearly do not exist, such as claims that this bill expands warrantless disclosure

When all parties in this House agreed to enact PIPEDA over a decade ago, we recognized that there were certain limited circumstances where an individual's right to privacy should be balanced to assist the public interest. For example, PIPEDA ensures that the right to freedom of expression is respected by allowing for information to be collected and used for journalistic or artistic purposes. Another example is that PIPEDA allows people to freely share information with their lawyer, even if it includes the personal information of another individual, to ensure the proper administration of justice.

PIPEDA allows private sector organizations to disclose individuals' personal information in order to conduct investigations that help protect Canadians from wrongdoing. This provision has always existed within PIPEDA. Bill S-4 does not expand this practice. Rather, our legislation would place tight rules and strict limits on when and how private organizations could share Canadians' personal information.

I would like to emphasize to the House the role of private organizations and how they can play an important role in creating a safe and secure society for Canadians. Consider, for example, self-regulating professional associations, like the College of Physicians and Surgeons of Ontario, the Law Society of Alberta, or the Association of Professional Engineers of Nova Scotia. These bodies have the legal authority to investigate their members and take disciplinary action where required. This may be because a physician is performing procedures that he or she is not qualified to perform; it may be because a lawyer is charging inappropriate fees to clients; or, it may be because an engineer is approving the drawings for a new building without actually reviewing them.

It is not difficult to see there is a real public interest in making sure that these professional associations have the ability to investigate complaints against their members and to ensure they are meeting high professional standards that benefit Canadian society. In order to do so, investigators must be able to obtain personal information that is protected under PIPEDA. For example, when investigating a complaint against a lawyer, the law society may request that the lawyer's firm provides access to his or her client lists, financial records, or calendar. All of these records could include personal information which normally could not be disclosed to investigators without the individual's consent.

Under PIPEDA as it now stands, investigators who want to access personal information without consent must be listed as an investigative body by Industry Canada. This involves coming forward to the department and justifying the need to access the information. This is an onerous process for organizations and for the government. For example, a simple name change by an investigative organization may lead to a year-long regulatory process before the change is reflected in the law.

During the first statutory review of PIPEDA, the House of Commons committee recommended that PIPEDA be amended to change the rules for private investigations and adopt a system that is consistent with both Alberta and British Columbia. Under these regimes, there is a general exception to consent for information sharing purposes of private sector investigations.

In essence, these provincial laws regulate the activity of private investigations rather than the organizations who conduct them. Bill S-4 would introduce similar rules to those that already exist in Alberta and British Columbia. By placing tight rules and stricter limits on when and how private organizations can share a Canadian's personal information, our government is complying with the recommendations made by the all-party committee.

Upon Bill S-4 being enacted, private organizations would be required to abide by four strict rules when sharing a Canadian's private information for the purposes of an investigation. It is important for Canadians to appreciate that despite these rules, private organization information sharing is voluntary. These rules only apply in the event that an organization agrees to disclose information for the purposes of an investigation. These rules are as follows:

First, the information can only be provided to another private organization, not the government and not law enforcement. Second, the information that is requested must be relevant to the investigation. For example, there is little reason that a social insurance number would be released for the purposes of investigating professional misconduct. Third, the investigation must pertain to a contravention of the law or breach of a contract. Finally, it must be reasonable to believe that seeking the consent of the individual to disclose the information would compromise the investigation.

To be clear, organizations that share information would continue to be subject to all other requirements of PIPEDA. The Privacy Commissioner and the Federal Court will continue to have oversight on this matter, and if an organization is found to be using the exemption provisions where it is not necessary, action would be taken by the commissioner or by the court.

The Conservative government always takes the privacy of all Canadians very seriously. Our fundamental beliefs, such as democracy, the right to own private property, and the right of freedom of association, are complementary. They are why we introduced the digital privacy act, to protect Canadians' private information in the digital age.

I look forward to the remainder of the debate and working with the opposition for all Canadians on how we can best protect individuals in the digital world.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would like to thank my Liberal colleague for her speech.

I am pleased that she raised some of her concerns about Bill S-4, in particular the negative impact it may have on the privacy of Canadians. All of the concerns that she mentioned were also raised by the Liberals during the debate on Bill C-13. However, in the end, the Liberals supported the government bill designed to spy on Canadians.

I would like to know if we can expect the same thing from the Liberals this time as well?

[Judy Sgro, Liberal, York West, ON]

Mr. Speaker, I am happy to be on my feet, adding a few comments on my concerns with Bill S-4.

I have to begin by saying that I am disappointed that the bill had to come from the Senate, rather than being introduced in the House as part of the ongoing committee work that we would have been doing. The government chose to have it introduced in the Senate and brought in through the back way.

On this side of the House, we will support sending the bill to committee. We have some very serious concerns when we combine the impact of Bills C-13 and S-4, but in order to ensure that we are being open and fair on this issue, that we understand it thoroughly, and that it does keep Canadians' interests in mind, we will support it going to committee. Hopefully, at that point, we will have sufficient time to get answers to the various questions of concern.

We are back discussing the Conservatives' type of approach, which is that one is either with them or against them. If we vote against the bill, it means that we are not interested in privacy rights, and if we vote for the bill, there is another side.

It is another one of those bills that continue to be very divisive in the House at a time when these are the kinds of privacy issues that we should be trying to work out together. I do hope that when we get to the industry committee, we have a good group there so that we can do some serious work in a non-partisan way. Maybe we can strengthen the bill in the end, by listening to some of the experts who have sincere concerns about it.

I do not mean to start out on a negative, but the truth is simple. We all need to be part of the debate today.

The way that the government looks at personal information, protection and privacy has already been subject to a Supreme Court ruling, and we have to give consideration to that. It is one thing to play partisan politics in the House and think that we are playing to the political base, but it is important that we listen to the rulings of the Supreme Court on privacy issues.

There are clearly those who have tried to make it sound like anyone who does not support the government is supportive of criminals. We have heard that before. However, the discussion is not as simple as that. The government's record on information protection has been embarrassingly negligent, so forgive me if I am not convinced that the recent scheme is worth passing without intense scrutiny.

We should all remember the matter of that lost hard drive, which held the social insurance numbers, medical records, birthdates, education levels, occupations and disability payment information of about 5,000 Canadians. That was lost. Perhaps the government wishes to plead incompetence on that side, or maybe it was an accident. We always like to be fair, so maybe it was an accident. Either way, the way that the government manages information needs extra study, which is why I am speaking on this today.

We are now looking at Bill S-4, but one cannot look at Bill S-4 without considering the implications of its companion legislation. Bill C-13, which is also before the House this week, would make it a crime to transmit pictures without consent, and it would remove barriers to getting unwanted pictures removed from the Internet. The stated intent of the bill is positive, but I have serious concerns with the provisions that would grant immunity to telecom companies that provide subscriber information to the police without even so much as a warrant.

I raise the issue, given that last April, Canada's interim privacy commissioner revealed that nine telecommunications companies received an average of 1.2 million requests from federal enforcement bodies for private customer information every year. That amounts to nearly 3,300 requests each and every day.

Those are shocking numbers, and it could be argued that the bill has, in effect, already been rendered unconstitutional by the Supreme Court. Last June, in an unrelated case, the court declared that law enforcement requires a warrant to get even basic subscriber data. Bill S-4 would allow private companies to share telecom subscriber data between themselves, something that would seem to contravene the Supreme Court's ruling.

How could that possibly be? Did the Senate miss this detail or did it fail to consider the implications of the Supreme Court's ruling? The truth is that the Senate passed Bill S-4 just days after the Supreme Court ruling, without even studying the implications. I guess the government is less concerned with that than pushing ahead with both Bill C-13 and Bill S-4. It is a lack of respect for the Supreme Court as well as Parliament.

Put simply, the legislation represents a paradigm shift in the way we deal with the release of private information. Traditionally, privacy laws outline the rules and procedures needed to protect information and personal data, but in this case, the legislation sets out circumstances under which that material can be released. Clearly, the implications of this change have not been fully considered and should be explored by the committee prior to passing final judgment on the pros and cons of the measures contained within Bill S-4.

My party and I will be voting to send it to committee for what we would hope is a thorough examination. Liberals want to ensure that law enforcement officials have access to the information they require to keep us safe, but a blank cheque approach is inappropriate. A blank cheque approach has been ruled unconstitutional by the Supreme Court and promises limited success in advancing societal protections when considered holistically. Why not take the time to do this right?

In a world where crimes involving data theft, identity fraud and online stalking are on the rise, protecting data is crucial. Data is not simply information. It is a commodity, it is power, and it is the doorway into the private lives of so many people. Liberals are deeply concerned that the government's commitment to safeguarding the personal information and privacy of Canadians is less than absolute. I am not suggesting the government is malicious. I do not believe that, but I fear it just does not understand the implications of Bill S-4.

Notwithstanding certain faulty or short-sighted legislative measures introduced by the government in the past, Canada is facing a genuine paradigm shift with respect to privacy protection, but privacy protection cannot be taken lightly. Whether protecting personal information from unscrupulous business interests, Internet stalkers and identity thieves, or rogue states bent on economic espionage, information security is crucial.

With these concerns in mind and as a leap of faith and confidence that our committee will have a chance to thoroughly examine this, I will be voting in favour of sending the bill to committee for further study. However, in return, I am also asking the minister to allow the committee to do its work honestly and freely without the involvement of the leadership so that the committee is allowed to really examine it thoroughly to ensure that if this goes forward, it goes forward with what I would hope would be unanimous support in the House on something as important as Canada's privacy rights. I believe that is quite doable, because at the end of the day we have the same objectives, to ensure Canadian privacy laws are strong and that Canadians are protected.

[Dany Morin, NDP, Chicoutimi—Le Fjord, QC]

Mr. Speaker, I thank my colleague for her excellent response. Members of my party and I are aware that in some emergency situations, there has to be access to information without a warrant. The problem with sharing information that way is that it seems to happen more often than circumstances can justify. The government has to strike a balance between protecting privacy and security. Bill S-4 does not strike that balance.

Can my New Democratic colleague tell me about her concerns with respect to that failure to strike a balance?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, the motion we are looking at today is unique in that it is the first of its kind in Parliament.

We have to wonder whether it is worth sending this bill to committee before it is passed at second reading, since that is not in keeping with the usual legislative process. While I have numerous concerns about Bill S-4, I still plan on supporting today's motion because I think that we can work together to improve the bill. However, that does not mean that I support the bill, and I must make that distinction.

As parliamentarians, we have been elected to work together and find effective solutions. That is what I am hoping to do today. I want to reach out to the government in the hopes of improving this bill because some of the elements are a step in the right direction.

As the hon. member for Chicoutimi—Le Fjord said, I introduced Bill C-475 in the House. That bill was designed to make significant changes to the Personal Information Protection and Electronic Documents Act, PIPEDA, to ensure it reflected the reality of the digital era. Unfortunately, the Conservatives voted against it. There could have been better protections in place, but we were unable to work together. This time around, I hope that will be possible.

It is extremely important that PIPEDA be updated, since it has not been updated since the very first iPod was introduced. Technology has evolved. Facebook did not even exist yet at the time. Things have really changed, and the law must reflect the current reality. This bill is a good first step, but it does not go far enough.

For instance, it is important to introduce a mandatory system for notifying users of data losses and data breaches. However, the model proposed by the government is subjective: organizations can decide whether the data breach is significant enough to report. In some situations, these organizations will not have the best means or knowledge to do this, especially the really small organizations. Is it really in their interest to disclose such data breaches? Probably not.

Bill C-475 proposed a model that was objective. That is one aspect that must absolutely be improved in order to better protect Canadians' privacy, and I hope this change can be made in committee.

It is important to implement a system that will ensure greater compliance with PIPEDA. With international digital mega-corporations in the picture, our laws are too frequently broken because there are currently no penalties. That is why we need a system of penalties to enforce corporate compliance with PIPEDA and Canadian privacy laws.

Unfortunately, Bill S-4 does not go far enough in this respect. It creates the option of putting together a committee that will act in good faith. Sometimes everyone acts in good faith and is happy, but that is not always how things work.

The commissioner has to be able to issue orders earlier in the process, but that is not what the government has proposed. That is what I proposed in Bill C-475, and that is another change that will have to be made to Bill S-4 before we can support it.

However, what really bothers me about this bill is the provision that would allow organizations to share personal information without a warrant and without the consent of the individual concerned. That is a huge problem. Even though this bill is called the digital privacy act, it contains a provision that could really interfere with the protection of privacy. I find that deeply contradictory.

It is also extremely important to point out that between the time that this bill was drafted and the debate today, the Supreme Court reiterated in its ruling that information such as data from Internet service providers on their clients, including their IP addresses, email addresses, names, telephone numbers, and so forth, are personal information and cannot be obtained without a warrant. Obviously, I am paraphrasing, but that is more or less what the Supreme Court ruled.

I have major reservations about the constitutionality of this provision of the bill. I asked the government to reassess it and withdraw it. Unfortunately, my request was not favourably received.

I think we could work together during review in committee on withdrawing this provision, which may violate the Canadian Constitution. I hope that is why the Conservatives want to send this bill to committee.

Obviously this is a Senate bill. During review in committee, a number of witnesses shared their concerns over this very provision. The Privacy Commissioner said the following in a brief:

Allowing such disclosures to prevent potential fraud [as provided for in clauses 7(3)(a.1) and 7(3)(a.2)] may open the door to widespread disclosures and routine sharing of personal information among organizations on the grounds that this information might be useful to prevent future fraud.

Indeed, the government wants to protect personal information, but allowing access to that information without a warrant, without consent, without any judicial oversight and without transparency is very problematic.

On many occasions, the government has used PIPEDA and its loopholes to call on Internet service providers and ask for Canadians' personal information. Why? We do not know. We do not even know exactly how many requests have been made, because this information is not available to the public. However, based on what the Privacy Commissioner revealed, we know that in a single year, government agencies made at least 1.2 million requests to Internet service providers to obtain personal information about their customers. That is a huge problem.

The government could have taken this opportunity to truly protect Canadians' privacy and to fix the loopholes in PIPEDA that allow this kind of information to be transmitted without legal oversight, without consent and without any transparency. It could have done that. I hope it will do so during the study in committee. That is very important. I am just making a suggestion.

We are debating the motion today. We are prepared to agree to study this bill before it passes at second reading, as is usually the case. I hope that this will be a gesture of good faith, and that the Conservatives will take this opportunity to fix the loopholes in PIPEDA and to eliminate the clause allowing organizations to share information without a warrant. We cannot support a bill that contains provisions that violate Canadians' privacy.

[Dany Morin, NDP, Chicoutimi—Le Fjord, QC]

Mr. Speaker, I thank the two previous speakers.

My colleague from Terrebonne—Blainville had some good questions for the parliamentary secretary. She even introduced Bill C-475, which proposed a number of provisions that can be found in Bill S-4.

Why did the Conservatives not vote in favour of the bill introduced by my colleague from Terrebonne—Blainville, even though several of the provisions in her bill are in Bill S-4, which they want to pass?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I appreciated the parliamentary secretary's speech; however, today we are debating a motion to send Bill S-4 to committee before it is even debated in the House of Commons. That is a rather exceptional measure. This is the first time this measure has been used since 2011. However, the parliamentary secretary did not provide an adequate reason for why the government wants to speed this process up. I hope it is to fix the mistakes in the bill, and to fix the fact that this bill violates our privacy by allowing organizations to share personal information with each other, without a warrant and without consent.

Can the parliamentary secretary provide a better explanation of why the government wants to send this bill to committee? If it is to make changes, what kinds of changes does the government have in mind?

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to rise today to speak to Bill S-4, the digital privacy act.

The purpose of the digital privacy act would be to strengthen our private sector privacy laws and to increase protection for Canadians when they surf the web and shop online.

The digital privacy act would provide a foundation on which the government would hold businesses to account on behalf of consumers. It would establish a new framework and new rules for how private businesses handle, use, and collect the personal information of Canadians.

This past April, the Minister of Industry launched Digital Canada 150, a comprehensive plan for Canada to take full advantage of the digital economy. It is a plan that has clear goals for Canada to be a competitive connected country by the time we celebrate our 150th anniversary in 2017.

Our government understands that when Canadians shop online or make purchases with their credit cards, they want their information to be safe. That is why we introduced the digital privacy act which would improve Canada's private sector privacy laws.

It is the unfortunate reality, in today's digital age, that we need to be more and more wary of hackers and electronic data theft.

Just this past year, businesses like Target, Home Depot and Kmart in the United States, had the credit card information of millions of people lost to hackers.

It is surprising, but under our current rules, it is not mandatory for companies to disclose the theft of this information to their clients.

Under the digital privacy act, companies would now be required to tell their clients when their personal information has been lost or stolen.

In addition, businesses would now need to report these harmful breaches to the Privacy Commissioner. Further to this, companies would need to keep a record of all privacy breaches that have occurred within their organization and the Privacy Commissioner would now have the ability to request information on any of these breaches.

The digital privacy act would also set out hefty penalties for companies that deliberately break the rules and try to cover up a data breach. Organizations would face fines of up to $100,000 per client they fail to notify that the data breach has occurred.

Let me now outline a few more ways the bill would help protect Canadians.

The digital privacy act would introduce stronger rules to protect vulnerable Canadians, like children and seniors, when they surf the web.

Many websites are focused on children, like educational online playgrounds or learning websites. Many times these websites, for marketing purposes, ask to collect personal information from the person using the website.

Under the digital privacy act, we would establish stronger rules and clarify that the wording that these companies use to request personal information needs to be simple enough that a child, or any target audience, can understand.

This means that if the consent required is too difficult for a child to understand, the consent would not be valid.

In addition, the digital privacy act would introduce limited and targeted exceptions where personal information could be shared without an individual's consent.

An unfortunate factor in our society is financial abuse. Currently, banks and financial institutions do not have the ability to alert the appropriate authorities when they suspect a senior is a victim of financial abuse.

The digital privacy act would now give an exception to banks and financial institutions to be able to alert law enforcement when they suspect someone is a victim of financial abuse.

Finally, the digital privacy act would give the Privacy Commissioner new powers to help enforce the law and make companies accountable when the rules are broken.

The Privacy Commissioner would now be able to negotiate compliance agreements with organizations that break the law. This would keep organizations accountable to their commitments to correct privacy issues.

In addition, the commissioner would now have one year, instead of 45 days, to take organizations to court if they do not play by the rules.

The digital privacy act would also give the commissioner a new ability to name and shame organizations that are not co-operating either with an investigation or with their commitments to fix their privacy issues. This would also allow Canadians to become more knowledgeable about issues that affect their privacy.

As technology and the marketplace evolve, we need to be more and more aware of how we can protect ourselves and our information.

The digital privacy act is common sense legislation that would help update our private sector privacy laws and would hold organizations to account when they lose personal information.

The Privacy Commissioner would now have increased power to help enforce the law and would also hold companies to account when they do not play by the rules.

I look forward to the continued debate in this House and to when the bill is referred to the Standing Committee on Industry, Science and Technology where we will hear from expert witnesses as we continue to discuss how to best protect Canadians in our digital world.

I hope all hon. members will join me in supporting Bill S-4.

(Bill S-4. On the Order: Government Orders)

June 17, 2014--Second reading and reference to the Standing Committee on Industry, Science and Technology of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act--the Minister of Industry.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, this afternoon we will continue with today’s NDP opposition day.

Tomorrow, we will debate Bill C-13, the Protecting Canadians from Online Crime Act, aimed at combating cyberbullying at third reading.

When we come back from our constituency week, on Monday, October 20, we will consider a motion to refer Bill S-4, the Digital Privacy Act, to the Standing Committee on Industry, Science and Technology prior to second reading. If we have extra time available that day, we will return to the second reading debate on Bill C-21, the Red Tape Reduction Act.

Tuesday, October 21, shall be the fifth allotted day. The Liberals will offer the day’s topic of discussion.

Starting on Wednesday, October 22, the House will consider Bill C-42, the common sense firearms licensing act at second reading. This bill would cut red tape for law-abiding firearms owners and provide safe and simple firearms policies. I would note that this legislation has already been endorsed by a number of key groups, such as the Ontario Federation of Anglers and Hunters, the Saskatchewan Wildlife Federation, the New Brunswick Wildlife Federation, the Canadian Shooting Sports Association, la Fédération québécoise des chasseurs et pêcheurs, the Manitoba Wildlife Federation, and the Nova Scotia Federation of Anglers and Hunters, among others.

Mr. Speaker, I do want to wish you and all members a happy Thanksgiving, and I hope that all will share that with their families.

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I am pleased to have an opportunity to respond to my colleague. On the question of question period, as I have observed before, the tone of question period is overwhelmingly determined by the tenor of the questions asked.

There was a very worthwhile letter to the editor in The Globe and Mail yesterday on exactly that subject from a gentleman from Halifax, which I was most appreciative of. I am sure that if the members of the opposition take heed of that, we will see very high-quality question periods in the future.

In terms of the business of the House, for the balance of today, we will be continuing forward on the Nááts’ihch’oh national park reserve act, Bill S-5. Tomorrow, it is our intention to complete the last day of Bill C-36. This is the bill to respond to the court's decision. The court has set a deadline for us in December, and we do want to respond to that. We will be proceeding with other matters on the order paper through the following week.

I do intend to identify Tuesday as an additional allotted day. I believe that it will be an opportunity for the NDP once again.

We have had some discussion in the House of the importance of the potential matter of the mission that is under way in combatting the ISIL terrorist threat right now. There is the potential for the schedule that I have laid out to be interrupted at some point in time by the need for a motion of the House, should there be a decision by the government to proceed with a combat mission.

I do not believe that I reported to the House exactly what we are going to be doing on Monday. On Monday, we will deal with Bill S-4, the digital privacy act, and Bill C-21, the red tape reduction act.

Privacy

[Annick Papillon, NDP, Québec, QC]

Mr. Speaker, on May 30, I asked the government why the Conservatives had such little respect for Canadians' right to privacy, a fundamental right, an immutable respect and non-negotiable right. According to documents we have obtained, we know that the Canada Revenue Agency committed roughly 3,000 privacy breaches and data breaches against Canadians in less than a year. That means there were more breaches at the Canada Revenue Agency this year than in all the departments combined since 2006, or when the Conservatives came to power. That is not trivial.

The changes the Conservatives are proposing would allow employees of the Canada Revenue Agency to hand over taxpayers' private information to the police without authorization from any sort of warrant. It is as though the Conservatives want to reward the Canada Revenue Agency for its mismanagement of private information, as we saw in recent scandals. Data breaches at the Canada Revenue Agency, the systematic collection of private information at airports and the passage of legislation facilitating access to private information without a warrant reinforce the perception that the government does not respect the right to privacy and that it is also opening the door to abuse with ill-conceived legislative reform.

The government introduced a series of bills that, according to experts, could have serious repercussions on Canadians' privacy. Indeed, Bill C-13, Bill S-4 and Bill C-31 enshrine a number of controversial practices in law.

The Office of the Privacy Commissioner of Canada has been sounding the alarm since last May. After revealing that the federal government is collecting vast amounts of personal information from telecommunications companies, the Privacy Commissioner's office then revealed that the federal government is also collecting personal information about Canadians from social networks.

Bill C-13 on cybercrime and Bill S-4 on the protection of digital information would allow telecommunications companies to provide personal information to other companies or law enforcement officials without a warrant. That is a very significant and serious issue.

I would like to quote a professor and intelligence expert from Laval University, Stéphane Leman-Langlois, who believes that Canadians should be very concerned. He said:

We can all agree that there is not very much privacy on the Internet, but still, there are some very weak protections in place. However, rather than strengthening privacy, which of course would be the best thing to do, the government is bombarding us with bills that will reduce those protections...

That is what is happening on the Conservatives' watch. They are reducing these protections and eroding respect for Canadians' privacy. As I said on a number of occasions, this truly is an intrusion into people's lives. That is very worrisome. We spoke about it last May, and I would like to talk about it again this month, now that Parliament is back in session, because it is really important.

The government did away with Statistics Canada's long-form census because it was too intrusive, but it has no problem allowing private companies to impinge on the privacy of millions of Canadians. That is completely hypocritical.

To shed some light on the consequences of these privacy bills, the NDP is asking for the creation of an independent panel of experts to examine how the government is using and storing Canadians' communications data.

Obviously, I am asking my colleague opposite to respond to this proposal. Does he intend to follow the NDP's recommendation and set up an independent panel of experts so that Canadians can be reassured with regard to their right to privacy, an immutable and fundamental right that all Canadians hold dear?

Motions in Amendment

[Ève Péclet, NDP, La Pointe-de-l'Île, QC]

Mr. Speaker, I am pleased to rise in the House for the second time to speak to Bill C-13, which addresses cyberbullying.

When the government announced Bill C-13 to combat cyberbullying, everyone thought it was a good idea. Perhaps the government had finally come up with a good idea. Everyone here knows that cyberbullying is taking a heavy toll on our youth. The people who work on the front lines—psychoeducators who work in high schools, street outreach workers and everyone else who works with youth—know how bullying can destroy lives, individuals and families. Some cases have made headlines, including the case of young Rehtaeh Parsons. Unfortunately, we know just how far cyberbullying can go. It can lead to suicide. No one in the House would say that we can remain indifferent about an issue as important as cyberbullying.

In the first speech I gave on Bill C-13, I emphasized the need to take action on the ground. I could even draw a parallel with the speech I just gave this morning on Bill C-36. The Conservatives often think they can use justice to solve all the problems inherent in a given situation. In the case of prostitution, for instance, inherent problems include poverty, exclusion and mental illness. The same is true when it comes to bullying. Some of the factors involved in bullying cannot be addressed through criminalization.

The provisions of Bill C-13, which makes it an offence to distribute intimate images, are a good start. In fact, the bill fits in with the bill introduced by my colleague from Dartmouth—Cole Harbour, which aims to prevent the kinds of situations that unfortunately led to the suicides of several young Canadians over the past few years.

Upon closer examination of the bill, one can see that it refers to various subjects ranging from cyberbullying to terrorism, banking information, telemarketing and theft of a telecommunication service.

Most of the provisions have very little if anything to do with cyberbullying. This bill is similar to the Conservatives' previous Bill C-30, which allowed access to Canadians' personal information.

The parliamentary secretary said that it was debated extensively and thoroughly examined in committee. That is all wonderful, except that all the experts agree that the study should have been even more thorough when it comes to the provisions regarding access to information. That is why we asked that the bill be split. Unfortunately, because we ran out of time, the provisions on cyberbullying were not examined much, if at all. We focused on the access to information provisions.

This issue is very important for our young people, and I find it extremely unfortunate that the debate is centred around access to information. That has nothing to do with our young students or the young girl who is being bullied by her classmates or receiving hateful messages on Facebook.

Access to information will have no impact on this girl, or perhaps it will, unfortunately, if the government wants access to her private information, which would be too bad. This is not going to help young people who need their government to work for them and do something about this.

A number of experts said that Bill C-13, together with Bill S-4, might have extremely significant repercussions on access to our private information, including access without a warrant.

I also asked a number of questions about an oversight mechanism. I would like to point out that the Conservatives refused to adopt such a mechanism. My colleague from Gatineau proposed an amendment requiring the department to report to Parliament on the use of this type of power. I would like to note that section 184.4 of the Criminal Code has already been struck down by the Supreme Court, not because the mechanism allowed information obtained without a warrant to be shared, but because application of that section did not include any oversight mechanism or notification mechanism. According to the Supreme Court, the rights of people being wiretapped were intrinsically violated because they did not know they were being tapped. At the end of the day, without an oversight mechanism, we are giving the police and the government power without accountability. We can agree that we are giving nearly absolute power to the minister and police officers to access Canadians' information.

The Supreme Court was clear. I have not even touched on the Supreme Court's recent decision in Spencer, which reiterates that telecommunications companies do not have the right to turn Canadians' private information over without a warrant. It is a violation and it is unconstitutional because there is no oversight mechanism.

I made a comparison with section 188, which was not struck down by the Supreme Court. That section allows for warrantless wiretaps, but it includes an oversight mechanism. The department is therefore obliged to report to Parliament on warrantless wiretapping.

According to the Supreme Court, this is clearly unconstitutional. Unfortunately, the Conservatives refused to adopt our amendments on creating such a reporting mechanism, which is too bad. We can already see that part of the bill will likely be challenged in court or even deemed unconstitutional.

Who will be the main victims of that challenge? My colleague from Gatineau told us several times. The main victims of the Conservatives' incompetence at drafting bills and studying issues thoroughly are the victims of bullying. The main victims will not be parliamentarians, lawyers or judges. No, the main victims will be victims of bullying, who unfortunately will have to wait for a legal challenge—which could take years and could go all the way to the Supreme Court—before justice is served.

I would like to underline the fact that when the Minister of Justice held his press conference, he said that Bill C-13 only legislated on a specific issue, namely cyberbullying. I know of several articles that quoted him as saying that this was not an omnibus bill and that its only purpose was to legislate on cyberbullying.

However, this bill contains a clause that gives not only peace officers, but also public officers access to these powers. Several experts wondered who would have access to these powers. Who would have access to Canadians' information? Would it be only the police, and only in specific situations, or would it be public officers from Revenue Canada in other situations?

This bill is so badly written that, unfortunately, the main victims who will be denied justice will be victims of bullying. Is that really what the Conservative government wants?

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Speaker, I want to know whether the hon. member for Gatineau agrees with me that there is something about this bill that is moving too fast and something that is moving too slow.

Does the debate that we are having here today and what has transpired on June 13 of this year not simply drive home the importance of the motion that this member brought before the House when the bill was introduced, that this bill needs to be divided?

The landscape has changed since this debate started. The Supreme Court of Canada pronouncement on June 13 has changed the landscape, as does the interaction with what is happening in the other place in Bill S-4, which also has a connection.

Given what has happened since the bill was introduced in the Supreme Court of Canada and in the other place, is the case for the dividing the bill not even more pronounced now than it ever was?

Criminal Code

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Speaker, I have indicated on countless occasions my profound concern about the ongoing effort of Conservative members of Parliament who introduce bills allegedly to combat crime. I have repeatedly made my concerns known that these crime bills are undermining the coherence of the Criminal Code of Canada. Far too often we find backbench MPs introducing private members' bills primarily relating to crime and justice, and more often than not based on input from the Prime Minister's Office.

I am also concerned that these private members' initiatives are not properly vetted to ensure their charter compliance. Unfortunately, that concern applies to government bills in too many cases, which, when introduced, immediately raise serious constitutional issues.

To underscore this concern we need only look at what happened yesterday with the Minister of Justice, who yesterday and again today was telling the House and the media bizarrely that the Supreme Court's ruling last Friday somehow was a victory for his government. More specifically, he was suggesting that there was something in the court ruling that was a victory for Bill C-13 and Bill S-4. Never mind that in the reality in which most of us operate, the court ruling undercuts both of those bills.

When it comes to so-called tough on crime legislation, whether from the government or backbench MPs, we on this side are more than a little suspicious of their motives. Moreover, we are concerned whether or not these bills, and there are many, are constitutional.

Again, the overall impact of these bills is to make the Criminal Code incoherent, which is unfortunate. The Criminal Code should not be used as a political fundraising tool, and I submit that the government has used these private members' bills and other government bills for no other reason than to raise money.

Today, however, as I indicated earlier, we may have a rare exception to that rule. We are debating Bill C-590 in the name of the member for Prince Albert. It was certainly encouraging to hear him say that he is open to amendments that would seek to achieve the objective of the bill.

As we know, Bill C-590 would amend the Criminal Code to increase mandatory minimum penalties for impaired driving where the offender has a blood alcohol content more than double the legal limit.

Currently, there are minimums for drivers over the legal limit and for convictions of impaired driving causing bodily harm or death. In most provinces, a minimum jail time does not apply for a first offence. As I indicated in my question earlier, there is an exception in Prince Edward Island. That is how the case law has developed. But in most of the country there is no mandatory jail time for a first offender with a blood alcohol level of 0.08.

The hon. member will be pleased to know that today, after careful consideration and consultation with my colleagues, I have recommended to the Liberal caucus that we support Bill C-590.

My major concern is with the use of mandatory minimum jail sentences. The hon. member would know that we opposed in principle the use of mandatory minimums, and we do so because there is no evidence to suggest that they work or are effective in reducing crime. We believe that mandatory minimums should be the exception and not the rule.

We will support sending the bill to committee because we agree with the objective of the bill, and at committee, hopefully we will have an opportunity to hear how best to achieve that objective.

I would like to take this opportunity to congratulate the member for Prince Albert for his effort. I believe he is sincere in that effort. I believe he is in fact seeking to make our roads and highways safer.

We all know that drinking and driving remains a serious issue in Canada. The number of bodily injuries and deaths caused by impaired driving continues to be unacceptably high. By targeting impaired drivers with a blood alcohol over 160 milligrams per 100 millilitres of blood, the act would create a specific deterrent to the class of drivers who pose the greatest statistical risk.

By dealing severely with the worst consequences of impaired driving, which are bodily injury and death of third parties, the act would also emphasize the rationale behind deterring impaired driving. Limiting judicial discretion is problematic, but this is, indeed, a serious enough issue that it merits further examination.

It should be noted that impaired driving continues to be a particular problem in locations and provinces across the country, including, and especially, in my own province of Prince Edward Island. In Prince Edward Island, the provincial government is doing what it can to address this problem. Just in the last session of the provincial legislature, a law was passed that would mandate a special license plate for chronic offenders of the impaired driving laws. This would allow police, but not the general public, to identify those who fall into this category. This is the type of innovative thinking that is required to combat this problem, not the automatic default to mandatory minimum jail time that we so often see.

Also in our province, as I indicated, the case law has grown such that there are sentencing guidelines for impaired driving offences. Those sentencing guidelines require that every single person in Prince Edward Island who is convicted of a drunk driving offence, whether it is at 0.08, 0.16, or whether it is a first offence, should bring their toothbrush, as we say, because they are going to Sleepy Hollow for the weekend, at a minimum.

Here is some relevant background information. The Traffic Injury Research Foundation has found that impaired drivers with a blood alcohol level at 160 milligrams of alcohol per 100 millilitres of blood represent close to 70% of impaired drivers killed in car accidents. According to Statistics Canada, impaired driving is the leading criminal cause of death in Canada.

Let me focus a bit on fatalities. It is estimated that in 2010, 2,500 individuals were killed in motor vehicle crashes in Canada. Mothers Against Drunk Driving Canada estimates that, at a minimum, 1,082 of these fatalities were impairment related. In MADD Canada's opinion, the 1,082 figure is a conservative estimate, due to the under-reporting that results from the inability to conduct alcohol tests on surviving impaired drivers, and from the need to rely on police reports. Moreover, the figure underestimates the percentage of crash deaths that involve drugs, thus the recent sharp increase in driving after drug use was not factored into the 1,082 figure.

Additionally, that 1,082 figure does not include individuals killed in impaired crashes on waterways. It was estimated that there were more 135 boating deaths per year from 2006 to 2008. It appears that more than 50% of those boating deaths involved alcohol and/or drugs. That 1,082 also does not include fatalities arising from aircraft, trains, and industrial vehicles, such as forklifts.

Given the limits on this 1,082 figure, MADD Canada estimates that there are somewhere between 1,250 and 1,500 impairment related crash deaths in Canada each year. That amounts to three to four deaths per day.

I would like to turn now to the matter of injuries caused by impaired driving. In 2010, it was estimated that about 300,000 individuals were injured in motor vehicle crashes. MADD Canada estimates that approximately 64,000 of those individuals were injured in impairment related crashes. That is roughly 175 per day. This figure is limited to motor vehicle crashes only.

There is also information available on property damage. In 2010, it was estimated that approximately 1.7 million motor vehicles were involved in property damage-only crashes in Canada. MADD Canada estimates that approximately 211,000 of these vehicles were damaged in impairment related crashes. That works out to 578 per day.

Finally, there is the financial cost. Using a social cost model, impairment related driving deaths, injuries, and property damage-only crashes in Canada can be estimated to have cost $20.6 billion in 2010. This model is recent, it is based on extensive analysis, and it was prepared for the Department of Transport.

This bill would meet a positive policy objective. People who drink should not drive. That may seem like a simple suggestion to us here, but far too often, people do drink and then decide that they are okay to drive. This is never acceptable and, on that point, I believe the House is united.

Privacy

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, Liberal senators failed to stand up for the privacy rights of Canadians in their review of the snooping provisions in Bill S-4, and the Minister of Justice stands in the House and tries to tell Canadians that the Spencer decision last Friday was somehow a validation of the government's attack on privacy.

The Supreme Court was clear. Obtaining private IP information on Canadians without a warrant is illegal. Why is the Attorney General, the man entrusted with upholding the Constitution, standing in Parliament and misrepresenting the conditions decided by the Supreme Court in order to support the Conservatives' attack on the privacy rights of Canadians?

Digital Privacy Act

[John Duncan, Conservative, Vancouver Island North, BC]

moved that Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, be read the first time.

(Motion agreed to and bill read the first time)

Message from the Senate

[The Acting Speaker, Conservative, Barry Devolin]

Before we resume debate, I have the honour to inform the House that a message has been received from the Senate informing this House that the Senate has passed the following bill to which the concurrence of the House is desired: Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act.

Resuming debate, the hon. member for London—Fanshawe.

Access to Information, Privacy and Ethics

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I move that the first report of the Standing Committee on Access to Information, Privacy and Ethics, presented to the House on Wednesday, February 5, 2014, be concurred in.

I always say what an honour it is to rise in this institution, but as I reflect on the government's response to the report on the Conflict of Interest Act, I have to say that I am not proud of what has been taking place in this Parliament.

We have what is being presented to the Canadian people as a Potemkin democracy. It is a false democracy. Democracy does not really happen here any more. It is a sideshow that Canadians are being exposed to on a daily basis in a House that has become a circus, an ugly circus, a vicious circus.

What we see here is an overall attack by the government against the institutions that are supposed to maintain the credibility of the Westminster tradition, a continued unmitigated attack on the various institutions that are supposed to bring accountability to this place. As Canadians watch the daily circus show and the silliness and the way the government has dumbed down important issues into little buttons that it can press at a given moment, what we see is the bigger issue that is being deflected which the Canadian public is not seeing, which is the attack on the credibility of the institutions that would hold some level of accountability.

Let us go through the standards that are supposed to be there to ensure a functioning democracy.

We hear of MPs who go back to their ridings and when people ask about the circus that they watch on TV, they will say, “Oh, yes, but committees are where the good work is done.” When I was elected 10 years ago I used to think that. I used to think that maybe on a given day it may be fairly mediocre in the House, but in committees, by and large we were there to do relatively good work, even if it was sometimes very partisan. Sometimes it was not the brightest. This is a democratic system after all, and it is what is it is, depending on who is elected. However, the notion of the committee had a place. That is not true any more. Committees have become circuses. They have become kangaroo courts. It is all done in camera or it is done to use the notion of majority to undermine even legislative positions that have existed since the Westminster tradition.

In England, in the U.K. Parliament, it is considered a failure of the committee if there is not unanimity, if oe has to bring forward a minority report. Unfortunately, we are having to bring forward minority reports all the time.

Nowhere is that clearer than in the circus of what happened at the ethics committee with the review of the conflict of interest guidelines. We heard from witnesses from across the political spectrum about the need to develop a coherent set of conflict of interest guidelines to hold government and the public office holders to account. What was delivered to the Canadian people in this report was an absolute democratic fraud.

The recommendations that were brought supposedly through the committee were never even raised by a single witness. I will get to the key recommendation, the number one recommendation that the government found in dealing with issues of conflict of interest. The conflict of interest review had raised all manner of issues, such as the need for administrative monetary penalties of a substantive nature, to ensure compliance with basic due diligence so that people were not just doing things for their friends or their pals, that there were clear rules to ensure that insiders did not have access, and that public office holders were acting in the public interest.

The number one recommendation that came out of this committee, and I want to say again it appeared in the report when we were examining it without a single witness having brought it forward, was that the definition of “public office holder” be changed. The government's notion of who will now be under the Conflict of Interest Act are the members who collectively bargain with the Government of Canada. They will now be public office holders.

What is a public office holder? A public office holder, according to the act, is a minister of the crown, a minister of state, or a parliamentary secretary. They will now have the same provisions around their conflict of interest as someone who does the vacuuming in a public office building for the federal government. Someone in Scarborough who works in a call centre for the federal government answering the phones is now going to have the same legal obligations as a minister of the crown.

Members of ministerial staff, all the little boys in short pants who write all those notes so the marionettes in the front row do not look so slow on a given day, and someone working in a secretarial function in an office in Calgary for the federal government will be treated as having to have the same responsibility for reporting their behaviour as the men in the little short pants who work for the Prime Minister's Office. A ministerial appointee under the Governor in Council will be treated the same as someone working at a Service Canada outlet in Moose Jaw, Kenora, or Timmins. That means there would now be between 240,000 and 300,000 people who are under the Conflict of Interest Act, whom the Conflict of Interest and Ethics Commissioner has to oversee.

The government approved this. Members of the government thought this was a good recommendation. They are laughing at us. They are laughing at the Canadian people. This is an absolute fraud of democracy when they decide that a minister of the crown, who can be bought and sold if there are not clear rules for lobbying and for conflict of interest, would be held to the same code as a person who goes into a government office in Winnipeg in the evenings and sweeps and cleans.

The Conflict of Interest Act was one of the key provisions of the Conservatives' commitment to have themselves elected in 2006. It is notable that the Conservatives made this promise that they were going to clean up the corruption of the Liberals in 2006. Their electoral platform was to give the ethics commissioner the power to fine violators—wrong; to enshrine the conflict of interest code into law—wrong; to allow members of the public, not just politicians, to make complaints to the ethics commissioner, which did not happen; to make part-time or non-remunerated ministerial advisers subject to the ethics code. It does not say anything about making 250,000 Canadians apply under the same code, a code that has no provisions for holding these ministers to account.

There is another fascinating recommendation that the government has brought in. If one of its ministers is under investigation, it has to be kept secret. It has to be kept secret to protect their reputation. It is a government that believes in maximum secrecy for its members while insisting on maximum transparency for average Canadians. That is a fundamental failure of accountability.

We had a Conservative member from London the other day who said that if people go to a public demonstration, why should the government not be able to keep tabs on them? The Conservatives believe that being able to spy on Canadians is their right, but if their ministers are under investigation, good luck investigating them because the Conflict of Interest and Ethics Commissioner would be absolutely swamped with the 250,000 civil servants she would have to deal with. We asked the Conflict of Interest and Ethics Commissioner what she thinks of this report and she said she is extremely disappointed. Of course she is, because it is making a mockery of her position.

The conflict of interest office is just one of the attacks the Conservatives have been making. Let us look at a few others.

We saw what they did with Marc Mayrand and Elections Canada and the attack on him personally. The insinuation was that Marc Mayrand in doing his job was doing it for partisan reasons. They wanted to make it illegal in Canada for Elections Canada to be able to tell Canadians about their rights to vote. International observers said that if Canada went down this route, it would fundamentally undermine the basic notion of democratic accountability.

We saw how they attacked the Parliamentary Budget Officer. Kevin Page, one of the most respected civil servants I have met in my career, was regularly ridiculed and undermined and attacked. His job, which was to provide members of Parliament with basic financial data, was interfered with every step of the way. I have to tell people back home that the House of Commons does not oversee the spending that is going on. It is a shell game that happens here. Billions of dollars are spent in all manner of categories, and yet the government makes sure that they keep members in the House of Commons in the dark. It's as though they were raising mushrooms on what they are feeding the House of Commons when it comes to actual information.

The one office to provide basic financial accountability, the Parliamentary Budget Office, was considered a threat and Mr. Page had to go. That is another one of the officers of Parliament that has been undermined.

There was the lastest appointment of the Privacy Commissioner. The Prime Minister ignored the recommendations of all the experts and picked Mr. Therrien, a lifelong civil servant, but one with no expertise in the privacy field. He was appointed over all the qualified people. Mr. Therrien was given a poison chalice with this appointment. As soon as Mr. Therrien was approved, the government attacked his credibility, because even Mr. Therrien, without the necessary expertise, recognized that the government's bills, Bills C-13 and S-4, on warrantless access and snooping on Canadians, were very problematic and probably were not legal.

The Privacy Commissioner was undermined. The Parliamentary Budget Officer was undermined. The Elections Canada office was undermined. Now with this report, the Conflict of Interest and Ethics Commissioner's office is being turned basically into a farce. She said that she has no ability to keep track of the 244,000 civil servants across this country when her job is supposed to be keeping an eye on a government that is mired in corruption.

These are respected institutions that provide accountability to Canadians when government does not want to be accountable. There is another key element, and that is the access to information office. The government now routinely tells the access to information officer that it will not comply with requests. It will give delays of 300, 600, 900 and 1,000 days on basic rights to access to information. Canada was a world leader on access to information 15 years ago. Now it is behind tin-pot dictatorships and third world countries in terms of providing information to citizens. The President of the Treasury Board runs around like some two-bit flim-flam artist talking about data sets and open government on his Twitter account. It is a farce. The Conservatives are making sure that the real key information that Canadians need is not being made available to them.

The Department of National Defence, the CRA, the justice department, and Indian affairs routinely stonewall and shut down the attempts of citizens and journalists to find out why decisions are made. If we do not know who was in the room when a decision was made or what source provided the information, we have no idea whether or not we are getting accountable government.

The government undermined the other institutions. We can talk about Rights and Democracy. We can talk about the round table on the environment. We can talk about Census Canada. I do not know what he is the minister of now, but he was the minister of immigration, and he is now running around trying to explain why he blew it so badly on the foreign worker program and saying he did not really have any data to go on and is having to look it up on Facebook and Kijiji. It is the same party that ridiculed and laughed at the Census Canada information that was considered the gold standard for information around the world.

There is another institution that the Conservatives attacked and undermined, and it is the one institution that so far has stood up to them. That is the Supreme Court.

I will not mention the Senate. We were taught in school that legislation goes from the House to the so-called chamber of sober second thought, but it is full of hacks, partisans, and friends of the party who rubber stamp bills again and again. They are not doing their legislative oversight. What ends up happening is the Supreme Court has to address bills.

Before I get to the issue of the Supreme Court, let us talk about the justice department. The justice department has a job to review legislation to ensure that it is charter compliant, that it meets the overall legal framework of this country. We see time and time again the advice that is given is ignored, or perhaps the Conservatives decide to favour their political masters, because this is a government that runs and butts its head again and again on the basic issues of the Constitution and the Charter of Rights and Freedoms. They are beginning to look increasingly ridiculous. Rather than the Conservatives stepping back and saying that they have to respect the Supreme Court, even though they will respect no other institution in this country, the Prime Minister personally led an attack on the Chief Justice of the Supreme Court.

The Conservatives attempted to bring in a judge who was not able to sit on the Supreme Court. They had legal advice on this. They ignored it. They created an unnecessary crisis.

We saw the Conservatives' prostitution law thrown out by the Supreme Court. The Conservatives have gone right back at the Supreme Court, banging their heads against it with a bill that will also be found unconstitutional, because it ignored the fundamental issues in the Bedford decision.

Nowhere is this more obvious than on the Spencer decision last Friday that talked about the fundamental legal obligation to get a warrant to get access to IP information and cell phone information. I heard one of the parliamentary secretaries the other day saying, “Oh my God, this is going to mean a four to six week delay in police investigations”. Nonsense. It is a one-day turnaround.

We also have, within the legal system in Canada, the right the police have, if they believe a crime is being committed, to get that information without a warrant. The proviso is that they have to be able to show to a judge later on that there was the urgency. There is still judicial oversight.

The government believes that there is no need for judicial oversight. We have a situation now where 1.2 million times a year, government agencies are grabbing information on private citizens without any apparent warrant. The government says that it is only being done in cases of extreme threat, terrorism, or violence. Obviously that is not true, given that there are 1.2 million requests a year.

All that being said, we had Vic Toews, who tried to bring in his warrantless snooping bill, who stood up in this House and told ordinary Canadians that they were on the side of child pornographers if they wanted to defend privacy rights. They put the run on Vic Toews pretty quickly.

The Conservatives then came back with Bill C-13, which would create the provisions to give legal cover for the telecoms to hand over this information, and Bill S-4, which would allow corporate interests to get at Canadians' information without warrant or disclosure to people.

The other provision, the absolutely bizarre one, is that the Conservatives are now going to allow personal tax information to be transferred without warrant or oversight. They somehow think this is going to get past the Supreme Court. Since Friday's ruling, it is clear that it is not.

Rather than use this institution for the benefit of all Canadians to ensure that we have clear, definable rules in this country, we are going to see the government running and butting its head against the Supreme Court and then howling like a victim when the Supreme Court does what its job is to do, which is to maintain legislative and constitutional obligations.

This brings me back to the Conflict of Interest Act. The government's response and its recommendations, which will protect its ministers, will dilute the act and turn the office of accountability into an unmanageable and unenforceable branch. It has completely broken the commitment it made in 2006 to Canadians.

It was very interesting when we heard from Ms. Dawson, the commissioner, the other day. We asked her about one of the most serious cases we have had in memory in terms of a breach of the act, which was the secret payment made out of the Prime Minister's Office to a sitting senator.

I am not a lawyer, but when I read section 16 of the Parliament of Canada Act, it says to make a payment to a sitting senator to make a political problem go away is an indictable offence. The RCMP chose not to follow through. The RCMP said that there was nothing to see here, ladies and gentlemen, move on. Yet when we looked at Corporal Horton's ITO, there were serious questions about who was involved in that $90,000, and it was clearly an issue of quid pro quo.

If the RCMP is not going to follow through, and the RCMP said that it had received all the legal advice necessary but did not appear to have talked to the Department of Public Prosecutions, which has oversight in this, then the issue goes back to Mary Dawson. Mary Dawson has no ability to go after the senators. The senators are in a closed world unto themselves. However, Mary Dawson does have the authority to investigate Nigel Wright. She says that she is not investigating Nigel Wright, because she is under the impression that the $90,000 was still under investigation by the RCMP. I find that surprising, because I do not know how it could be illegal to receive the money but not illegal to pay the money. I am not exactly sure. I think Ms. Dawson would do us all a favour if she could explain.

This is the kind of work Ms. Dawson is intended to do. It is to ensure that secret payments are not made to insiders, that backroom pals do not have access that ordinary Canadians do not have. This is why we were supposed to have the Federal Accountability Act. Unfortunately, with the motion and the report, the government has signalled that it has no intention of following through on those commitments.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I am pleased to have another opportunity to respond to the Thursday question from the hon. member for Burnaby—New Westminster.

I know how proud he claims to be about showing up to work. In fact, though, the New Democrats seem to have a spotty record on that. Last evening, that very member rose to speak to our government's bill to protect our communities and exploited persons—that is Bill C-36—and after one whole minute he moved to adjourn the House. He said we should all go home. Maybe that is the parliamentary equivalent of taking one's ball and wanting to go home when one is unhappy with how things are going in another meeting.

In any event, we did all dutifully troop into the House to vote on that at 6 p.m. However, what was very revealing was that only 61 of those 98 New Democrats stood in their places to vote. A few of them were missing their shifts, oddly. We did not find that on the Conservative side. In fact, we just had two votes in the House, and the number of New Democrats who were not standing in their places was very similar to that.

Therefore, when I ask myself who is not showing up for work, I can say it is not the Conservatives not showing up; it is, in fact, the New Democrats.

However, following the popular acclaim of last week's Thursday statement, I would like to recap what we have actually accomplished in the House since last week in terms of the legislative agenda.

Bill C-37, the riding name change act, 2014, which was compiled and assembled through the input of all parties, was introduced and adopted at all stages.

Bill C-31, the economic action plan, act no. 1, was adopted at both report stage and, just moments ago, at third reading.

Bill C-24, the strengthening Canadian citizenship act, was concurred in at report stage.

Bill C-20, the Canada-Honduras economic growth and prosperity act, was passed at third reading. Of course, the NDP tried to slow down its passage, but Conservatives were able to get around those efforts, as I am sure the 50 New Democrats on vigil in the House last night fondly appreciate, and we were able to extend our hours because there were, again, not even 50 New Democrats here in the House to stand in their places to block that debate as they wanted to. So we did finish the Canada-Honduras bill that night, and were able to vote on it.

The government's spending proposals for the year were adopted by the House, and two bills to give these plans effect, Bill C-38 and BillC-39, were each passed at all stages.

Bill C-22, the energy safety and security act, was reported back from committee, and several other reports from committees were also tabled. As I understand, we will see Bill C-17, the protecting Canadians from unsafe drugs act, reported back from the health committee in short order.

Finally, this morning we virtually unanimously passed a motion to reappoint Mary Dawson as our Conflict of Interest and Ethics Commissioner.

Sadly, though, the New Democrats did not heed my call last week to let Bill C-32, the victims bill of rights act, pass at second reading. We were treated, sadly, to only more words and no deeds from the NDP.

Turning to the business ahead, I am currently anticipating the following debates. This afternoon and tonight, we will finish the debate on Bill C-36, the Protection of Communities and Exploited Persons Act, at second reading. That will be followed by third reading of Bill C-24 and second reading of Bill C-35, Justice for Animals in Service Act (Quanto's Law).

Tomorrow morning, we will debate Bill C-24, if necessary, and Bill C-18, Agricultural Growth Act, at second reading. After question period, we will get back to Bill C-32, and give the NDP one more chance to send the victims bill of rights to committee.

The highlight of Monday is going to be the report stage of Bill C-6, the Prohibiting Cluster Munitions Act. Tuesday’s feature debate will be Bill C-2, the Respect for Communities Act, at second reading. Wednesday will see us finish third reading, I hope, of Bill C-6. During the additional time available those days—in addition to Thursday and Friday of next week—I will schedule any unfinished debates on Bill C-18, Bill C-32 and Bill C-35.

I will also try to schedule debates on Bill C-22 and Bill C-17, as well as other bills, such as Bill C-3, the Safeguarding Canada’s Seas and Skies Act, at third reading; Bill C-8, the Combating Counterfeit Products Act, at third reading; Bill C-12, the Drug-free Prisons Act, at second reading; Bill C-21, Red Tape Reduction Act, at second reading; Bill C-26, Tougher Penalties for Child Predators Act, at second reading; Bill S-2, Incorporation by Reference in Regulations Act, at second reading; Bill S-3, the Port State Measures Agreement Implementation Act, at second reading; and Bill S-4, the Digital Privacy Act—which I understand we will receive shortly from the other place—at second reading.

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Chair, I think the government would agree with me that part of the goal in this legislation is to modernize police powers, to modernize their investigative tools, to catch up with where technology has brought us in this day and age. I know I've said a lot of things in this meeting and often do say things they disagree with, but I think we can agree on that.

I hope we can also agree it's a fast-moving train in terms of what is happening in the world around social media and IT generally. It's fast evolving, and legislators and people in the enforcement field are having a hard time keeping up with the advancement in technology.

If we can admit we're in a rapidly changing environment, I would suggest to you it just makes good sense that we come back and examine whether what we've been doing in the course of amending this legislation stands up, whether it still fits three years down the road.

The sole purpose of this amendment is to require us to come back and take a look at what we've done and see if it still works.

This isn't by any means a foreign concept. We did it when we radically changed how we treat veterans. We had a study here in this session about the changes that were made with respect to trials in both languages.

Just last week the Minister of Industry appeared before a Senate committee on the digital privacy bill, something I've argued is intertwined with what we're doing here. This won't be terribly long, but I want to share with you an exchange between Minister Moore and Senator Eggleton on May 28 at the Senate committee that is studying Bill S-4.

Senator Eggleton said to him:

I agree with you; it's an evolving universe. I think in that regard it's also important to have parliamentary oversight. When PIPEDA was first put in place, there was to be a review every five years, and I think there was a review in 2007, but there hasn't been one since then. This is perhaps something that needs to be corrected to make sure that we can keep up with the changes in the universe and that Parliament can keep on top of this issue.

The minister said:

Quite right, and here I am, doing my best. But you're quite right. When we did the Copyright Modernization Act, and I think I may have been before this or another committee with a similar mandate, we wrote into that legislation as well, the copyright legislation, which I know is always a fight because it's often a zero-sum game when dealing with IP law. There are often governments, ours included, who find it a struggle to find the right balance, certainly, in a minority Parliament and the pressures associated with that, to arrive at the right balance. So we put in place in the Copyright Modernization Act a mandatory five-year review of the legislation so that politicians, regardless of their political willingness, are forced to maintain the best possible IP regime.

What I am proposing is entirely consistent with Minister Moore's testimony in front of the Senate committee. It's entirely consistent with other practices when we're forging new ground, especially in an environment that's as rapidly changing as this one.

All the amendment does is it mandates us to come back and take another look at the changes we've made.

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Chair, many of the comments I have with respect to this amendment would be along the lines of what you just heard from Ms. May on her last amendment.

I can't begin to tell you how disappointed I am with the response of the government on the last one. I thought they cared about what Carol Todd said. This amendment is entirely consistent with what Carol Todd said. I thought they cared about what the Privacy Commissioner said. After all, they fiercely supported his appointment. This amendment is entirely consistent with what the Privacy Commissioner said.

Not a single telecommunications company has asked for civil and criminal immunity, not a one. In fact, of every witness who appeared before this committee who was asked what motivated the insertion of this immunity against class action lawsuits, nobody could identify a single party who asked for immunity, no one.

It strikes me as a wee bit odd that yesterday we were sitting here and talking about whether or not transgendered persons should be protected, whether that clause should be put in, the amendment that was proposed by Mr. Garrison. The response from the government was that they didn't hear from any witnesses who asked for it. That very same argument can be made with respect to this immunity. We didn't hear from a single witness who said they want this in the bill.

Contrary to what Mr. Dechert said in his last submission, and contrary to many of the questions he's been putting to witnesses, this does change the law. Section 25 of the Criminal Code has a reasonableness standard when there is voluntary production of documents to police authorities. That reasonableness standard, as we have heard from several witnesses, has been removed with this immunity. What this immunity does is it allows people to act unreasonably. It gives them immunity for acting unreasonably in their cooperation with authorities. That's what this does.

We heard from several witnesses with respect to the joint impact of this provision with Bill S-4. When you take Bill S-4 and this provision together, what it means is that it is not just public officers, it's not just peace officers, it's anyone. Anyone in a contractual dispute can now get private information without consent, without disclosure.

We know now, although not because there is any transparency reporting, that this is widely used.

The purpose of this amendment is to prevent the widening and expansion of the non-consensual distribution of subscriber information. As far as I'm concerned, that is one of the most important changes that can possibly be made to this bill. We heard it time and time again. I would certainly hope that the government would respect the evidence that has come forward to this committee. A monopoly on good ideas doesn't exist on the other side of this room.

Thank you.

Privacy

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I am hoping that the minister can dial into the House and tell us if he has read Bill S-4. There are some serious questions about it, such as the fact that it would allow corporations to go to other corporations to take private information on Canadians, without consent, without notification, including their private Internet use.

My question is, did he think it was a good idea to give corporations this free hand to snoop, or did he just not understand the legislation and that this loophole has created open season for spying on Canadians?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, according to the privacy commissioner, 97% of companies collect personal information about their clients. In the digital age, that information can be shared or stolen more easily than ever. Bill S-4 contains some important measures, but also some ill-conceived measures that will allow companies to share information without a warrant and without notifying their clients.

Will the government agree to amend this bill in order to correct these dangerous measures?

[Ève Péclet, NDP, La Pointe-de-l'Île, QC]

Thank you very much, Mr. Chair. I also want to thank the commissioner for joining us today.

I just wanted to echo what my colleague said.

It's great that we have had several hours of debate in the House of Commons and in committee. However, I think it's important to mention that most of the experts agreed on one matter. They felt that the study of the bill should have been carried out in a more comprehensive manner when it comes to the provisions on access to information. Unfortunately, we could not examine the provisions of other bills, especially Bill S-4.

Although we have carried out a good study, we could have considered the issue in more depth. We could have taken into account other bills that could have an impact on the application of Bill C-13.

My first question is about your presentation. You talked about a lack of accountability mechanisms. In fact, Bill C-13 contains no oversight mechanisms or provisions for notifying individuals whose data has been shared.

For instance, section 184.4 of the Criminal Code was struck down by the Supreme Court, not because those mechanisms made it possible to share information obtained without a warrant through wiretapping, but rather because that section did not provide for any oversight or notification mechanisms. The people who were tapped by police officers were never notified of that fact.

I will make a comparison with section 188, which allows for a quick examination by a judge owing to the urgency of the situation. So the Supreme Court ruled that section 188 was valid, since it included an oversight mechanism.

Could you expand on the requirement, in Bill C-13, to comply with, on the one hand, section 8 of the Canadian Charter or Rights and Freedoms and, on the other hand, the ruling of the Supreme Court that calls for such a mechanism?

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, that is simply not the case. We are talking about Bill S-4.

Again, if my colleague is opposed to the bill, she ought to tell her colleague who is responsible for telecommunications policy, her colleague from Terrebonne—Blainville, who said, “We have been pushing for these measures and I am happy to see them introduced.... Overall, these are good first steps”.

That was the NDP position when we tabled the bill, because the digital privacy act does exactly, in substance, what the NDP asks for us to do rhetorically, which is to protect the privacy of Canadians online and protect their transactions, so that when their information is violated or if their information has been stolen, they are immediately notified, and if they are not, there is punishment. The Privacy Commissioner is empowered.

Bill S-4 goes a great way to protect Canadians online, and the NDP should know that.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, we have empowered the Privacy Commissioner and the Privacy Commissioner's office. As I said, we have gone further in Bill S-4.

The ethic behind the member's question is frankly a sound one. That is why we have acted as a government and moved forward both in the Copyright Modernization Act and in this Parliament with Bill S-4.

The Privacy Commissioner has welcomed these changes. Because we recognize that as Canadians are migrating their businesses and their personal lives online, we want to ensure that Canadians are protected online and that the Privacy Commissioner's office is empowered to investigate abuses of Canadian citizens online. That is why we are taking action.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, my colleague knows very well that Bill S-4, which is before Parliament, protects the interests of Canadians online.

I know my colleague has seen the bill because the member herself said about Bill S-4, “I welcome the proposals in this bill. This bill contains very positive developments for the privacy rights of Canadians”.

Bill S-4, the digital privacy act, was supported by the Privacy Commissioner Chantal Bernier. It is supported by Canadians all across the country who recognize the need to protect Canadians' privacy rights online. The member herself spoke favourably of the bill. I am disappointed to see her change of heart.

[Cara Zwibel]

The provision in Bill S-4 that has the most relevant link to Bill C-13 is a provision that expands the exceptions in PIPEDA, which I mentioned earlier.

Right now there's an exception, so that a company does not have to seek an individual's consent before disclosing their information to law enforcement or government agencies in certain circumstances. This would expand that to include other organizations that might be requesting information where there's an allegation of breach of contract, for example, copyright claims, and things of that nature.

Really, the problem is that it puts the holder of the information, a private corporation, in the seat of an arbitrator of a contractual dispute or a law enforcement issue, and those are the things that should be done with judicial oversight.

The immunity provision in Bill C-13 obviously plays a big role. In our view. If the provision in Bill S-4 passes, there is an incentive for companies to hand over more information both to law enforcement and to others requesting information. We think the incentive should be going the other way.

[Sean Casey, Liberal, Charlottetown, PE]

Ms. Zwibel, you're aware that there is presently a piece of legislation before the Senate, Bill S-4, Digital Privacy Act. I think it's been admitted by the minister that there is a link between it and Bill C-13, yet both the minister and his officials were either reticent or outright refused to discuss it.

Why is the link between these two pieces of legislation important?

[Tamir Israel, Staff Lawyer, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic]

Thank you, Mr. Chair and members of the committee.

Good afternoon. My name is Tamir Israel, and I'm staff lawyer with the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic. CIPPIC is very grateful for this opportunity to provide our input into this important study on the growing problem of identity theft and its economic impact. I'll cut my comments a bit short, given the time constraint, so that if there are questions, there will be a bit of time for them.

In many ways identity crime is the crime of the information age. The U.S. Federal Trade Commission's Consumer Sentinel Network collated and classified over two million consumer complaints in 2013, and identity theft complaints comprised the top category across all these. Identity theft is a vehicle for a range of identity crimes. The false identities built on this theft are used to procure loans, government benefits, and fake credit cards. These false identities are also used as a jumping off point for other crimes. As a result, the economic and social costs of identity crime remain difficult to measure.

In spite of these difficulties, it is safe to say that identity theft is on the rise. Identity theft 2.0 is taking hold, where identity thieves take full advantage of the rich information stores available on social media and mobile devices with increasingly savvy methods. Illegal online markets for identities have developed where e-mail account access, credit card numbers, and full identity profiles can be bought and sold en masse. The OECD estimates that lists of valid e-mail addresses can be purchased at between $1.70 U.S. to $15 U.S. per megabyte, and that access to compromised e-mail accounts ranges from $1 U.S. to $ 20 U.S.— or it did in 2009—depending on the black market fluctuations. Putting aside the economic costs, however, the most insidious impact of identity crime is on the individual who's the victim of identity crime. The time, effort, and trauma involved with recovering from identity crime cannot be easily measured in economic terms.

In the remainder of my comments I'll address three essential and necessary components of any comprehensive response to the problem of identity theft. They are prevention, research and education, and victim support. Before turning to these I wish to speak briefly about another essential component, which is investigation and enforcement.

We've done a lot in Canada to improve the ability of our various agencies, including the Office of the Privacy Commissioner of Canada, the Competition Bureau, and our various law enforcement agencies, to investigate identity crimes as well as to address many of the underlying offences that facilitate these types of offences. That being said, these initiatives include the addition of several Criminal Code provisions and the passing of S.C. 2010, c. 213, which is Canada's anti-spam and spyware legislation. These steps have been critical, but it's important to recognize that identity theft is here to stay, and an enforcement solution alone will not be enough to address the problem. With that, I turn to some of the other solutions that are necessary to supplement what we've done in Canada.

First and foremost, more needs to be done to help individuals protect their identity information so that it doesn't end up in the hands of identity thieves in the first place. The most effective way to do this is through stronger data protection frameworks, including a stronger PIPEDA and Privacy Act.

PIPEDA in particular needs to play a central role in any comprehensive response to identity crime. Today's social networks and mobile devices are a repository of information, but this information is often disclosed in unexpected ways, be it to the general public or to invisible third-party applications. PIPEDA also obligates organizations to put in place reasonable technical and other safeguards in order to prevent unauthorized access to customer data. Security breaches are not only becoming more frequent with each passing year, but the number of identities exposed with each breach is increasing dramatically. Symantec's “2014 Internet Security Threat Report” registered a 260% annual increase in the number of identities exposed by each average breach, meaning that these are essentially cyber-breaches targeting large repositories of data in one go. This makes the adoption of strong technical safeguards a very important tool in the prevention of identity theft.

Against this backdrop the need for a PIPEDA framework that is rigorously enforced and applied has never been greater; however, the current framework does not reflect this. As this committee recognized in its recent study, “Privacy and Social Media in the Age of Big Data”, quoting former Privacy Commissioner of Canada Jennifer Stoddart, with the emergence of Internet giants, the balance intended by the spirit and letter of PIPEDA is at risk, and the risk of significant breaches and of unexpected, unwanted, and even intrusive use of people's information calls for commensurate safeguards and financial consequences not currently provided for in PIPEDA.

Bill S-4, currently before the Senate, takes an incremental step towards making PIPEDA somewhat more enforceable by providing for optional consent orders. However, full enforcement powers and administrative monetary penalties for non-compliance are required, so that companies have effective incentives to comply proactively with PIPEDA's obligations. Bill S-4 will also enact far overdue breach notification obligations. These will obligate companies to report any privacy breaches that raise a real risk of substantial harm to affected individuals and to the Privacy Commissioner of Canada. A company that fails to disclose will be guilty of an offence and subject, upon summary conviction, to a fine of up to $10,000. While the breach notification obligation in Bill S-4 is a positive step forward, it is not sufficiently calibrated to deter security breaches. It focuses too closely on the risk of direct harm to an end-user resulting from a specific breach. In reality, in many instances it will be difficult to know whether a particular vulnerability was or was not exploited, meaning that much laxity in technical safeguards will remain unreported. This makes it an ineffective mechanism for encouraging and incentivizing companies to strengthen up their technical safeguards.

Recently a number of government departments have also seen high-profile breaches. These have included, for example, a breach over at HRSDC involving a hard drive that contained sensitive information for over 500,000 students who had applied for student loans. In spite of this, the Privacy Act lacks not only a breach notification obligation but also the basic obligation to adopt technical safeguards.

I'll turn now to research and education. In addition to prevention, a comprehensive response to the problem of identity theft requires education and outreach initiatives. A number of government agencies have developed some solid identity crime-specific consumer education materials. The Competition Bureau's “Little Black Book of Scams” is a good example. It's available online if anybody wants to take a look. These are supplemented by growing efforts by non-governmental bodies such as the Canadian Identity Theft Support Centre, whose Victim Toolkit is an excellent resource, as is some of their other stuff, which they've already talked about. But more can be done, particularly with respect to education on the victim recovery process.

There is also a need for coordinated and sustained research on the scope and parameters of identity crime. There has been minimal systematic research on this within Canada since about 2006. While there are some non-Canadian initiatives that provide some insight into the scope and parameters of the problem within Canada, there is a need to stimulate and coordinate more Canada-specific research on identity crime through an initiative such as the breach repository that Kevin was talking about.

Finally, I turn to victim support, and I'll make this brief, because my colleagues here did an excellent job of outlining many of the elements that are necessary for an effective victim support framework. Many of my comments overlap with theirs, so I'll just make this brief.

The recovery process for an identity crime is highly complex. Victims must deal with creditors who are reluctant to believe their debt is not theirs. Even if a victim is successful in convincing immediate creditors, bad credit ratings can follow victims of identity crime for years. A number of steps can be adopted to mitigate these problems. For example, a customer seeking to convince creditors she is a victim of identity crime will often need to undergo completely diverse and complex processes for each provider in order to prove her identity. Often these will require different documentation, and this greatly multiplies the hours it takes to recover one's identity. In this vein, the type of standardized documentation provided by entities like the Canadian Identity Theft Support Centre is really crucial. It's also crucial to make sure that it's accepted by both law enforcement and service providers as an acceptable means of providing documentation of identity theft. Other useful and necessary tools would be the availability of cost-free credit freezes and online access to credit reports, which this committee heard about earlier.

Finally, the ongoing availability of a victim support centre is essential to the overall recovery process. Having someone to talk victims through the identity recovery process and to assist them in their dealings with law enforcement and other agencies as well as with creditors is essential.

Overall, a national strategy on identity crime victim support should be adopted that will establish clear parameters for cooperation between the various entities involved in the victim support process, such as the Canadian Anti-Fraud Centre, the Canadian Identity Theft Support Centre, and the various regulatory agencies that deal with identity theft matters. It should also establish a clear road map for adopting these various identity recovery mechanisms.

Thank you.

[Stephen Anderson]

Yes, absolutely.

I think that when Canadians are seeing the Snowden revelations and at the same time hearing--not only through this legislation but also Bill S-4--the revelations about CSEC and CSIS.... I think when people hear those stories over and over again, it does limit the discourse and free expression online, and I think that's a problem. I also think it limits our digital economy, because in our digital economy online services are based on trust, and I think Canadians are increasingly losing trust in online services. I would say that in a kind of extra-judicial underhanded way, they're finding out that their data is being handed over to a range of authorities without a warrant. That doesn't make people want to participate in the digital economy. That doesn't make people want to invest in the digital economy. The North American tech sector has been losing billions of dollars since the Snowden revelations, and I think that's an important thing for us to consider here as well.

[Dr. Michael Geist]

Sure, and I certainly agree with what Mr. Turk had to say. I think it likely is that potential liability coming around to class action, but at the same time, I would suggest that if we take a look in totality around the privacy policy issues, both with this bill and with Bill S-4, those actually suggest that the government is promoting and pushing towards more voluntary warrantless disclosure. We see it with an expansion of that kind of provision within Bill S-4, and we see it here now providing immunity regarding the disclosures that do take place.

What it does is send a signal, I think, to those who collect information, telecom companies and others, that we are going to create and we are moving towards a framework that will encourage that voluntary cooperation, that voluntary disclosure, without the courts.

We've heard, I think consistently, from other members on the panel that this bill is striking the right balance. They say that consistently with the proviso that the court is involved. Let's recognize that, in these circumstances, the court is not involved when these voluntary disclosures take place.

[Dr. Michael Geist, Canada Research Chair, Internet and E-commerce Law, University of Ottawa, As an Individual]

Thank you, Mr. Chair.

Good morning. As you heard, my name is Michael Geist. I'm a law professor at the University of Ottawa. I have appeared many times before committees on digital policy issues, including privacy, but I appear today in a personal capacity, representing only my own views.

As you may know, I've been critical of the lawful access bills that have been introduced by both Liberal and Conservative governments. But I want to start by emphasizing that criticism of lawful access legislation does not mean opposition to ensuring that law enforcement agencies have the tools they need to address crime in the online environment.

As Ms. McDonald can attest, when her organization launched Project Cleanfeed Canada in 2006 I publicly supported that initiative, which targets child pornography by working to establish a system that protects children, safeguards free speech, and contains effective oversight.

In the context of Bill C-13 there is similar work to be done to ensure that we do not unduly and unnecessarily sacrifice our privacy in the name of fighting online harms. As Ms. O'Sullivan just stated, there is a balance to be struck, and as Carol Todd told this committee, we should not have to choose between our privacy and our safety.

Given the limited time, let me start by saying that I support previous witnesses' calls to split this bill so that cyberbullying can be effectively addressed in the way that we have just heard and that we can more effectively examine lawful access. Moreover, I support the calls we've heard for a comprehensive review of privacy and surveillance in Canada.

I'm happy to discuss these issues further during questions, but I want to focus my time on the privacy concerns associated with this bill. In doing so, I'll leave the cyberbullying provisions for others, such as those we've just heard, to discuss.

With respect to privacy, I want to focus on three issues: the immunity for voluntary disclosure provision; the low threshold for transmission data warrants; and the absence of reporting and disclosure requirements.

First is the creation of an immunity provision for voluntary disclosure of personal information. I believe this immunity provision must be viewed within the context of five facts. Firstly, the law already allows intermediaries to disclose personal information voluntarily as part of an investigation. That's the case for both PIPEDA and the Criminal Code.

Secondly, intermediaries disclose personal information on a voluntary basis without a warrant with shocking frequency. The recent revelation of 1.2 million requests to telecom companies for customer information in 2011 alone, affecting at least 750,000 user accounts, provides a hint of the privacy impact of voluntary disclosures.

Thirdly, disclosures involve more than just basic subscriber information. Indeed, this committee has heard testimony directly from law enforcement, in which the RCMP noted:

Currently specific types of data such as transmission or tracking data may be obtained through voluntary disclosure by a third party....

In fact, since PIPEDA is so open-ended, content can also be disclosed voluntarily, so long as it does not involve an interception.

Fourthly, intermediaries do not notify users about their disclosures, keeping hundreds of thousands of Canadians in the dark. Contrary to some of the discussion we have heard, there is no notification requirement within the bill to address this issue.

Fifthly, this voluntary disclosure provision should also, I think, be viewed in concert with the lack of meaningful changes to Bill S-4, which would collectively expand the warrantless voluntary disclosure provisions to any organization.

Given this background, I would argue that the provision is a mistake and should be removed. It unquestionably increases the likelihood of voluntary disclosures at the very time that Canadians are increasingly concerned about such activity. Moreover, it does so with no reporting requirements, oversight, or transparency.

To those who argue that it merely codifies existing law, let me say that there are at least two notable changes, both of concern.

The first is that it expands the scope of “public officer” to include the likes of CSEC's and CSIS's employees and other public officials. In the post-Snowden environment, with global concerns about the lack of accountability for surveillance activities, this would run the risk of increasing those activities.

The second is that the Criminal Code currently includes a requirement of good faith and reasonableness on the part of the organization voluntarily disclosing the information. This new immunity provision does not include those requirements, potentially granting immunity even when disclosures are unreasonable.

In short, this provision isn't needed to combat cyberbullying; nor is it a provision in need of updating to combat cybercrime. In fact, I'd argue it is inconsistent with the government's claims of court oversight. I believe it should be removed from the bill.

The second issue I want to focus on is the low threshold for transmission data warrants. As you know, Bill C-13 contains a lower “reason to suspect” threshold for transmission data warrants, and as many have noted, the kind of information sought by transmission data warrants is more commonly referred to as metadata. Some have tried to argue that metadata is non-sensitive information, but that is simply not the case.

There has been some confusion at these hearings regarding how much metadata is included as transmission data. I want to state that this is far more than the question of who phoned whom for how long. It includes highly sensitive information relating to computer-to-computer links, as even law enforcement explained before this committee.

This form of metadata may not contain the content of the message, but its privacy import is very significant. Late last year, the Supreme Court of Canada ruled in R. v. Vu on the privacy importance of computer-generated metadata, noting:

In the context of a criminal investigation, however, it can also enable investigators to access intimate details about a user’s interests, habits, and identity, drawing on a record that the user created unwittingly....

Security officials have also commented on the importance of metadata.

General Michael Hayden, the former director of the NSA and of the CIA, has stated, “We kill people based on metadata.”

Stewart Baker, the former NSA general counsel, has stated:

Metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.

There are numerous studies that confirm Hayden's and Baker's comments. For example, some studies point to calls to religious organizations that allow for inferences about a person's religion, and calls to medical organizations that can allow for inferences on medical conditions. In fact, a recent U.S. court brief signed by some of the world's leading computer experts notes:

Telephony metadata reveals private and sensitive information about people. It can reveal political affiliation, religious practices, and people’s most intimate associations. It reveals who calls a suicide prevention hotline and who calls their elected official; who calls the local Tea Party office and who calls Planned Parenthood. The aggregation of telephony metadata—about a single person over time, about groups of people, or with other datasets—only intensifies the sensitivity of the information.

These are their comments—the comments of security experts in the area.

Further, the Privacy Commissioner of Canada has released a study on the privacy implications of IP addresses, noting how they can be used to develop a highly personal look at individuals.

Indeed, even the justice minister's report, which seems to serve as the policy basis for Bill C-13, recommends the creation of new investigative tools in which “the level of safeguards increases with the level of privacy interest involved”.

Given the level of privacy interest that is involved with metadata, the approach in Bill C-13 for transmission data warrants should be amended by adopting the “reasonable grounds to believe” standard.

My third issue is transparency in reporting. The lack of transparency, disclosure, and reporting requirements associated with warrantless disclosures should be addressed. This combines both PIPEDA and lawful access, but it is made worse by Bill C-13. The stunning revelations we have seen about requests and disclosures of personal information—the majority without court oversight or warrant—point to an enormously troubling weakness in Canada's privacy laws.

Most Canadians have had no awareness of these disclosures and have been shocked to see how frequently they are used. The bills before Parliament seek or propose to expand their scope. In my view, this makes victims of us all, through disclosure of our personal information often without our awareness or explicit consent. When asked for greater transparency, such as we see in other countries, Canada's telecom companies have claimed that government rules prohibit it.

I hope the committee will amend the provisions that make warrantless disclosures more likely. But even if it doesn't, it should surely increase the level of transparency by mandating subscriber notifications, record-keeping of personal information requests, and regular release of transparency reports. These requirements could be added to Bill C-13 to lessen the concern associated with voluntary warrantless disclosure. Moreover, such reporting would not harm investigative activities and would hold the promise of enhancing public confidence in both law enforcement and communications providers.

Finally, I'd like to conclude, with all respect, by pointing to a personal incident involving one of the committee members, Mr. Dechert, that highlights the relevance of these issues.

Many will recall that several years ago Mr. Dechert was himself the victim of a privacy breach, with personal emails that were sent to journalists and were then widely reported in the media. This incident ties together several issues, which I have tried to highlight.

First, privacy interests arise even when you have nothing to hide and when you have done nothing wrong. The harm that arose in that case, despite no wrongdoing, demonstrates the potential victimization that can occur without proper privacy safeguards.

Second, much of that same information runs the risk of voluntary disclosure. Indeed, the expansion of the police officer definition means that in theory even political opponents could seek voluntary disclosure of such information and obtain immunity in doing so. Moreover, there is no notification in such instances.

Third and perhaps most important, the content of the emails that were disclosed was largely irrelevant. It was the metadata—who was being called or contacted, when they were being contacted, where they were being contacted, and for how long—that would itself allow for the same inferences that were mistakenly made during that incident. The privacy interest was in the metadata, which is why a low threshold is so inappropriate.

This kind of privacy harm can victimize anyone. As I've mentioned, we know that at least 750,000 Canadian user accounts are voluntarily disclosed every year—one every 27 seconds. It's why we need to ensure that the law has appropriate safeguards against the misuse of our personal information and why Bill C-13 should be amended.

[John Russo]

For example, one pertinent point is the amendments to PIPEDA, in terms of Bill S-4, doing away with the investigative bodies. That would help both organizations in terms of working with all members of the financial industry to prevent fraud. You wouldn't be limited to those who have subscribed and been approved as investigative bodies. That would be information sharing that could be shared amongst the bureaus and the financial credit granters.

[John Russo]

To start, Bill S-4 is a good initiative in terms of giving consumers a little more power proactively to know when their information's been compromised. So mandatory breach notification, something that many U.S. states have already.... Hopefully this bill does pass the third time around in terms of creating that notification so that when individuals have their information compromised, lost, or stolen at an organization they're aware of it. Most times institutions may bury their heads in the sand and not do anything, or if they're not subject to any fines or penalties, they're less likely to do anything. That's one key in terms of legislative changes.

Carol.

[Michael Spratt]

Yes. What we're looking at under PIPEDA is that with regard to the information disclosed for the purposes of law enforcement, there's no necessity to disclose to the person who you're talking about, who the information pertains to. Bill S-4 takes it a step further, of course, and says it's not just law enforcement or the government, but it's other organizations as well. We see in Bill C-31 that no longer are there strict controls over the sharing of information between Revenue Canada and other organizations.

This is a pattern, and it's a concerning pattern. To that extent, if would be very useful if this issue could be studied in depth in relation to the other issues that impact it as well.

[Lawrence MacAulay, Liberal, Cardigan, PE]

Thank you very much.

The minister and department basically refused to talked about the combined effect of Bill S-4 before the Senate and the bill before the Senate committee. Should Canadians be concerned about this issue?

[Michael Spratt]

I don't agree. I think a reading of the legislation would logically lead one to that conclusion.

The minister said that the obligation to disclose to an individual when their information has been disclosed was covered under PIPEDA. It's not. It's quite clear, when you look at PIPEDA, that subparagraph 7(1)(c)(ii) doesn't require that there be any disclosure to the individual.

When the minister says that it must comply with section 25, that's simply not accurate when you look at the text of section 25, which requires that the person disclosing “acts on reasonable grounds”. And reasonable grounds isn't just asking for the information—“I need this information for an investigation”—and then having the telco comply and give it to you. That's not reasonable grounds. If reasonable grounds is required for the protection of section 25, the case can be made to a judge.

It's not the case that this hamstrings investigations. In my experience, in the case of some of the tragic examples that this committee has heard, it's not the case that it would take 30 to 60 days to retrieve that information. That's simply not how it works.

The section that the minister was speaking of broadens the ability to ask for that information. Certainly combined with other bills, such as Bill S-4, it raises severe privacy concerns in terms of the broadening of that information. It's not consistent with section 25, which requires reasonable grounds.

In fact, the countless hundreds of thousands of example that we've heard about over the last month about this sort of voluntary disclosure is troubling, and this does nothing to address that. It does nothing to address notifications to persons affected.

What's the danger with people asking for this information? I'm sure you've all read the stories about record checks, police checks, state storage of information, disclosure of that information.That's the danger. It's not an answer to say that if you have nothing to hide, you should be willing to give this information over. What's the harm? The harm is done when the charter is breached. That's the standard. The tie doesn't go to the victim. The tie should go to the charter, which is the supreme law and should be respected.

Privacy is not about hiding. It's not about secrecy. Privacy is about a person's right and ability to control the information about them and their freedom of choice. Just as I have a privacy interest in my voice when it goes through the telephone lines at the telecommunications companies, I also should have, and citizens should have, privacy interests in other data. It's a misnomer to say that the legislation makes it clear that this just subscriber data, i.e., name. That's not what it says. It's the type, duration, date, time, size, origin, destination, and termination of your data and anyone else's data.

When that net is cast, I say there's not even close to a tie here. The police aren't hamstrung. They can take the appropriate steps and we can be protected. Police can do their job, and at the same time, we can respect not only individuals' privacies but also comply with the strict standards that we're entitled to under the charter.

[Todd Skinner]

We are in line with the ISO standards, and on a regular basis, audit under SSAE 16 requirements.

Our data would seem to point to the lack of awareness in industries outside the financial sector and show that there's more need for education in this area, not only in the obligations emanating from a breach but also in awareness around security protocols to prevent a breach.

Awareness by breach notification where warranted will be useful. TransUnion is supportive of the efforts of the government on the part of Bill S-4. While we do not want to inundate customers with notifications, where there is a material risk of harm, there are benefits to customers receiving notification.

Here are some stats on impacts for consumers and TransUnion. The number of potential victims has increased by 600% in the last five years. The number of confirmed fraud victims is up by 100%. Many of these consumers report these frauds to the Canadian Anti-Fraud Centre—PhoneBusters—and while there has been a 300% increase in the number of fraud alerts placed, we still have work to do.

These compromises have a short-term impact on TransUnion and Equifax, increasing call volumes to our centre and requests for alerts to consumer disclosures. We've invested in technology to make that process as effective as possible and to help contribute to that 300% increase in the number of fraud alerts placed on consumer bureaus. What we're doing is helping to reduce the numbers of frauds, and we're pleased that it's not increasing at the same rate of potential victims.

Who pays? The cost is borne entirely by the consumer unless the companies or government bodies that have caused the compromise are willing to step up and pay for the damages that are created. We believe that the burden and those costs should be borne by the companies that compromise the information of the consumer. Not all companies take on this responsibility and agree to pay for these solutions to reduce potential harm to the consumer in mitigating risk.

What should be done? First is notification to the Privacy Commissioner. TransUnion is supportive of the amendments under PIPEDA in this regard in Bill S-4. Where a loss of sensitive financial data has been confirmed, both bureaus should be informed. Where a loss of sensitive financial data has been confirmed, fraud alerts should be placed on both bureaus—at a minimum—to reduce the likelihood of ID theft. As an example, we serve our clients differently, and if a breach has occurred and somebody notifies Equifax, that fraud could still be committed if they go to a financial institution that is serviced primarily through TransUnion. In many cases, both bureaus should be notified.

With respect to synthetic identity, my colleague John Russo talked about synthetic identity and its impact on the Canadian market. In defining the issue, it really is about recreating an identity to commit fraud. In the synthetic fraud, there is no one to complain. There is no constituent to talk to. It is a cost that is borne by many indirectly. In regard to public security, CBC has reported on a few stories, and John referred to the billion dollars in losses that Canadians absorb through different fees and costs. Every consumer pays for synthetic fraud.

How do we work towards a solution? We work with police authorities to report such suspected activities. We take this information, put it into our fraud database, and report it to financial institutions.

The prevention of these crimes requires better technology to ensure that identity cards are not easily replicated and that they cannot be authenticated. If we really want to attack this issue, it also requires the sharing of information between government agencies and the financial sector. The lack of sharing creates silos, and fraudsters take advantage of that.

Today, there's no automated method whereby the private sector can get confirmation as to whether or not a particular piece of ID has been issued by the government or whether that actual ID belongs to the individual who claims it's theirs. TransUnion and Equifax can help by being the conduit to financial institutions, as we already provide, for example, identity verification for AML or KYC. Both of these have been noted in the RCMP paper, the “National Identity Crime Strategy”.

In closing, TransUnion is supportive of the initiative to crack down on identity theft by, first, reporting of breaches through Bill S-4 and notification to both bureaus where a data breach of sensitive financial information has been confirmed, and second, ensuring that companies responsible for the breaches bear the burden and the cost for data breaches, not consumers. Third, on the lack of education and awareness outside of the financial sector in the area of data security and safeguarding, TransUnion is supportive of the data breach notification where circumstances warrant as a key to raising that awareness. Fourth, we are also supportive of a focus on and attention given to synthetic identification, allowing for the sharing of information from government to financial institutions for fraud and ID theft prevention, and investing in security measures for identification cards that are relied upon by the private sector for AML purposes and fraud prevention.

Mr. Chair and committee, thank you very much for having us here today.

[Michael Spratt, Member and Criminal Defence Counsel, Criminal Lawyers' Association]

Thank you. It's always a pleasure to be here.

As you may know, the Criminal Lawyers' Association is a not-for-profit organization comprising more than 1,100 criminal defence counsel from across Canada. One of our objectives is to educate not only our membership but also the public on issues relating to criminal and constitutional law. The CLA has routinely been consulted and invited by various parliamentary committees to share its views on proposed legislation pertaining to these issues. The CLA supports legislation that is fair, modest, constitutional, and supported by the evidence.

To cut to the chase, the CLA is simply unable to support Bill C-13. Quite simply, Bill C-13 is not only overly broad but is also likely unconstitutional.

Bill C-13 purports to be concerned with tackling cyberbullying by stopping the spread of intimate images that are disseminated without the subject's consent. The real tragedy of Bill C-13 is that those provisions are necessary, laudable, and should be proceeded with; however, in reality that aspect takes up only a small percentage of the bill. Bill C-13, in the balance, sacrifices privacy in favour of expanded police powers and liberal disclosure standards.

Bill C-13, along with Bill S-4 and Bill C-31, represents a dangerous and in our opinion unconstitutional pattern of erosion of privacy.

Let me speak of the cyberbullying provisions. They are important, are laudable, should be proceeded with, and are indeed necessary in the modern world that we live in. Largely, I don't have any objection to the small percentage of the bill that deals with those provisions.

Having said that, I would add that there is a legitimate argument that those provisions in and of themselves may be overly broad, in that the standard imposed for the mens rea is “recklessness”. That standard of recklessness may go too far, in that it may make individuals potentially liable who don't know or could not have found out the circumstances to which the images that are the subject of that provision relate. To that extent, the problem with the cyberbullying provision is not necessarily its aim but rather its execution in that one small regard.

The bill's aim is to punish those who transmit intimate photos sent to them, when the person who took those images has an expectation of privacy. That is likely to have significant public support, as it should; however, the scope of the provision is potentially overly broad, because it expands the mens rea element. By making “recklessness” one of the potential mens rea standards for that offence, the provision may catch not only the individual who was the original recipient of the image but also those down the line—the second-hand recipients of that image—who may have no knowledge of the circumstances in which that picture was taken or made.

Some caution comes from Don Stuart, a pre-eminent expert in the field of criminal law. As he points out in Canadian Criminal Law, the fifth edition, there is a risk that the recklessness standard can devolve into a far broader conception of fault than is desirable, and a more nuanced approach would involve defining recklessness as knowledge both of the risk and that that risk was likely.

That provision can be seen in other aspects of the code; for example, in item (a)(ii) of section 229, which deals with murder.

A modified recklessness standard in the cyberbullying provision would target the so-called “revenge porn” conduct, without drawing to the net those who simply pass on the photos without context and may not necessarily be as morally culpable.

If the provision is allowed to remain there without a clearer definition of recklessness, the section may attract some charter scrutiny. At that point, the issue would become one of over-breadth: does that section capture individuals who may not be morally blameworthy, but may nonetheless be captured under the recklessness standard? As I said, this is a minor issue with that aspect of the bill.

More troubling is the “lawful disclosure” aspect of Bill C-13. The bill announces itself as being about cyberbullying and protecting Canadians from online crime, but certainly it far exceeds those parameters.

I will start by saying that of course the most controversial aspects of Bill C-30 have been removed—the mandatory warrantless disclosure of basic subscriber information. However, there are still some serious concerns. I'll deal with two issues.

The first is that there is simply insufficient judicial oversight in obtaining those orders.

Now, the Supreme Court of Canada has recently considered the standard for reasonable suspicion, which is the standard we're dealing with in the legislation, in the case R. v. Chehil. The court made it crystal clear that the standard of reasonable suspicion falls well below the normal requirement of reasonable and probable grounds. That's the normal standard we usually deal with. Specifically, the Supreme Court said that the state's interest in detecting and preventing crime begins to prevail over the individual's interest in being left alone at the point where credible-based probability replaces suspicion.

The data, which is the subject matter of the searches contemplated in Bill C-13, contains a great deal of personal information. It's a misnomer to simply call it metadata. That dilutes the importance and impact of that data.

I understand that a pre-eminent expert in this area, Dr. Michael Geist, will be testifying at this committee later this week, and I think he will agree that metadata is deserving of an increased level of protection. And indeed he's not alone in that view. When we look at reports in 2013 from the Information and Privacy Commissioner of Ontario and the Office of the Privacy Commissioner of Canada, both reports reveal the heightened expectation and the intimate information that can be revealed through metadata. I would commend you to read those reports. It's quite shocking what can be discerned about an individual's communications and basic information about the individual through simply an IP address or some of the other metadata that's discussed.

Metadata as a starting point has a heightened expectation of privacy, and that is something that has been echoed by the Supreme Court, which agrees seemingly with Dr. Geist and with the privacy commissioners. In the recent case of Vu, which dealt with metadata found on a personal computer, the Supreme Court of Canada adopted the Criminal Lawyers' Association's submissions—we intervened in that case—finding that ordinarily this information, metadata, can help a user retrace his or her cybernetic steps. In the context of a criminal investigation, however, it can also enable investigators to access intimate details about a user's interests, habits, identities, drawing on a record that the user created unwittingly. Of course, in modern times there's a capacity to store, catalogue, and cross reference this information, revealing more and more.

The Supreme Court's comments about the heightened privacy inherent in this type of data is simply incompatible with the proposed reasonable suspicion standard that's found in Bill C-13. That incongruity exposes this proposed legislation to charter scrutiny, and in my opinion supports a conclusion that there's not only charter scrutiny here but indeed charter infirmity. There's simply no principled and justifiable reason that the new warrant provisions contained in Bill C-13 should not be based on the traditionally and judicially approved standard of reasonable and probably grounds.

Next, moving to the issue of the incentives for non-judicially supervised disclosure, Bill C-13 will also likely lead to an increased request for a telecommunications company to disclose information without court oversight and the corresponding protections. Privacy in this regard should be strengthened and not abandoned. Falling back on section 25 in the current Criminal Code is no answer to this problem. If you read section 25 carefully, you will see that section 25 requires reasonable grounds, and no comfort can be found in the appeal legislation as it offers no protection.

Of course as we see with that existing provision in Bill C-13, it broadens the scope of disclosure. No longer will the requesting organization be under an obligation to actually be enforcing or administering an act. The room for those requests is greatly increased. And indeed we see codification of the civil and criminal immunity which isn't in section 25, and as I said, section 25 requires reasonable grounds, which is completely absent in this section.

The real concern is that the expansion of police power and limiting liability for the party agreeing to disclose will result in increased police fishing expeditions, and of course we have seen from some reports some very alarming information about current practices in that regard.

Indeed, it would have been preferable to have discrete legislation on both the cyberbullying and on the lawful access legislation. However, given the current formulation of Bill C-13, the CLA recommends that the standards for obtaining those warrants be strengthened and brought in line with what the current Supreme Court case law would suggest is appropriate. No one wants to see evidence excluded. No one wants to get it wrong at the outset, and years later find out that the constitutionally suspect legislation was passed, evidence was excluded, and prosecutions were jeopardized because things weren't done right the first time. The provisions respecting the voluntary disclosure should be reconsidered to ensure both fairness, respect of privacy, and ultimately, constitutionality.

[James Moore, Conservative, Minister of Industry]

Thank you, Mr. Chairman.

Thank you, Mr. Chair.

Thank you for the opportunity to make this presentation before the committee today. I am joined by my Deputy Minister, John Knubley, as well as other individuals whose names you just mentioned.

I'm pleased to be able to speak to you today about much of the important work that our government is doing, and how we have delivered on what we've said was the top priority for Canadians in this session of Parliament, which of course is creating jobs and economic growth. This work begins building the groundwork for our economic future, which I believe is a digital future for Canada.

Last month, in Waterloo, I was pleased to launch Digital Canada 150, an ambitious plan for Canadians to take full advantage of the opportunities in the digital age. It's a plan that sets clear goals for a connected and competitive Canada by the time we celebrate our 150th birthday in 2017. Digital Canada 150 is based on submissions that were received by thousands of Canadians during consultations that were held all across the country. There are five pillars, 39 new initiatives, and one national plan for 35 million Canadians. It's a broad-based plan that will guide Canada's digital future, and I'll give you one example.

In Digital Canada 150, we connect over 280,000 households with access to high-speed Internet at five megabytes per second. That's fast enough to stream high-definition video, enable e-commerce, and connect Canadians with educational and career opportunities in all parts of this country. It's a bold plan when you consider that Canada is the second-largest country in the world in size, but 37th largest in population. To be able to tie us altogether with that digital infrastructure is something that I think we should all be very proud of.

Our plan is also based on and has been praised for its vision. Google Canada called Digital Canada 150 a plan that “will accelerate digital adoption and technological innovation among Canadian businesses, which is essential if we are to remain a global economic power.”

The Federation of Canadian Municipalities published the following statement:The rural businesses, communities and residents need sufficient bandwidth to participate in today's global economy and today's announcement is good news for Canadians in those regions.

Finally, OpenText, Canada's largest software company, called Digital Canada 150 “the foundation for a connected and competitive Canada”.

Of course, connecting Canadians also involves making the right decisions to ensure access to wireless spectrum. Canadian consumers increasingly rely on their iPhones, their iPads, their smart phones, tablets, and BlackBerrys, to stay connected with loved ones, to work, to organize their businesses, to organize their studies, and to use it for every aspect of everyday life.

In March, I announced the results of a 700-megahertz spectrum auction, which is the highest quality spectrum ever auctioned in Canada. A 700-megahertz spectrum travels longer distances, it requires fewer cell towers, penetrates building walls, elevators, and even through underground parking lots, which of course means better connectivity, fewer dropped calls, and more effective use of technology.

As you will no double remember, consumers were of course the big winners following the auction results. Ten Canadian companies, in over 100 rounds of bidding that lasted five weeks resulted in a total of 97 licences being awarded to eight Canadian companies. Quality wireless spectrum was acquired by Rogers, Telus, and Bell, with a fourth wireless player obtaining spectrum capacity in every region of Canada. The total revenue generated from this auction was $5.27 billion, proving the critics wrong and earning the greatest return ever for a wireless auction in Canada.

That was one of the many strategic decisions made by our government in the wireless sector in order to achieve a very clear objective—that of delivering more choice, lower prices and better service for Canadian consumers.

In pursuit of this goal to offer consumers more choice, lower prices, and better services, we have taken deliberate action on a number of fronts in the wireless sector.

First, we will not approve any spectrum transfer request that decreases competition in our wireless sector.

Second, we liberalized foreign investment rules in our telecommunications sector.

Third, we also believe that communities need to have more say in how cell tower locations are identified and how they move forward. That's why we introduced new rules to require wireless companies to share cell towers whenever they can, so that fewer towers are needed in our communities. We, of course, also mandated community consultation on all cell tower construction to ensure communities have a voice in how new cell towers are offered and introduced into their communities. The Federation of Canadian Municipalities welcomed this and joined me at my announcement. These changes are already making a real difference in communities all across the country.

We've also capped wholesale wireless roaming rates to promote greater competition. We've also empowered the CRTC to impose financial penalties on wireless carriers that don't play by the rules. In 2015, we will also be holding the 2,500-megahertz spectrum auction with rules specifically designed to benefit consumers, particularly those Canadians who live in rural communities.

Simply put, we are connecting Canadians like never before both with our broadband strategy and with our wireless policies. Of course, Canada's information and communications technology sector is one of Canada's key economic drivers, generating $155 billion in revenue each year, contributing over $67 billion to Canada's economy, and creating over 570,000 well-paying jobs all across this country.

To sustain these considerable contributions, our government is committed to ensuring our employees, students, researchers, and businesses all have the skills and opportunities that are necessary to succeed in our global economy.

Digital Canada 150 will invest $200 million to help small and medium-sized businesses adopt digital technologies. An additional $300 million will be invested in venture capital for digital companies.

Forty million dollars will be allocated to support 3,000 internships in high-demand fields. An additional $100 million will be provided in funding for the Canada Accelerator and Incubator Program. In total, $36 million will be earmarked for the Computers for Schools program, so that public libraries, not-for-profit organizations and aboriginal communities can be provided with the equipment students need to access the digital world.

Recently, I travelled to Silicon Valley, just south of San Jose and San Francisco, to discuss Canada's digital advantage with some of the world's leading technology companies, including Google, Twitter, Microsoft, and Facebook. There I hosted a digital innovation forum where I partnered with Canadian entrepreneurs to sell Canada as the Silicon Valley of the north. I was told first-hand how Canadian companies across Canada are leading digital technology innovation and positioning Canada as a top investment destination.

Mark Barrenechea, who's the CEO of OpenText, Canada's largest software company, put it this way. He said that they choose Canada because of the highly educated workforce, Canada's strong university partnerships, and our robust and innovative start-up communities. “The digital economy is the engine that will drive [Canada's] growth and prosperity. Technology and innovation is the fuel that will power this engine”.

Of course, our government understands that a strong digital economy requires strong protections for Canadians when they surf the web or shop online. In this Parliament, we've tabled the digital privacy act. Our digital privacy act will require organizations to inform consumers when their personal information has been lost or stolen. Companies that fail to do so, or deliberately break the rules, will face fines of up to $100,000.

The new measures also establish stronger rules to ensure that vulnerable Canadians, particularly children, fully understand the potential consequences of companies collecting and using their personal information.

The Digital Privacy Act will also vest in the privacy commissioner improved powers to take the necessary enforcement action and hold offenders accountable.

Before the bill was introduced, I met with the acting Privacy Commissioner, Chantal Bernier. I want to thank her for supporting the measures our government has implemented.

Here's what the Privacy Commissioner said about the digital privacy act. She said that “there are some very positive developments for the privacy rights of Canadians”, that she is “pleased” that the government has addressed issues such as breach notification, and that she welcomes the proposals in this bill. Of course, this committee will have an opportunity to study that legislation and offer suggestions on how the bill might be improved as we go forward.

On science, we are working on a renewed science and technology and innovation strategy, a long-term plan to position Canada as a globally recognized leader in research and business innovation. We're making record investments, as a country, in these areas to push the boundaries of knowledge, increase prosperity, and improve the quality of life of Canadians.

As a result, Canada leads the G-7 in research and development investments at universities, colleges, and in research institutions, and has one of the most educated populations in all the world. Canadians who witnessed the extraordinary success of Commander Chris Hadfield as commander of the International Space Station and his mission will know that Canada has an extremely proud history of accomplishment in space. We were the third country in the world to put our own research satellite into orbit and the first to have our own communications satellite.

Earlier this year I announced a new space policy for Canada, a framework that will guide our future in space. I was very pleased to have the support, I must say, of not only Commander Hadfield, and current and past astronauts, but also Marc Garneau, a colleague of ours in the House of Commons to whom we reached out prior to tabling this, who offered his support for our policy as well.

As we approach our 150th birthday in 2017, we want to ensure a strong and commercially competitive space industry that will continue to inspire Canadians for years to come, and of course, all the associated sciences.

Canada has a dynamic aerospace and space industry, which provides more than 170,000 individuals with highly paid positions, and it contributes over $27 billion a year to the Canadian economy.

The Aerospace Industries Association of Canada applauded our plan, saying that we have recognized the important role Canadian innovation and our proud heritage play in the space sector.

Chris Hadfield himself said, he's “glad to see the new Canadian government support for the space industry”, which will contribute to new jobs in the space economy.

On the auto sector, Mr. Chair, the auto industry is, of course, one of the cornerstones of the manufacturing sector of the Canadian economy. It contributes $16.1 billion annually to our economy, which represents about 10% of Canada's total manufacturing GDP. Our budget this year nearly tripled our investment in Canada's manufacturing sector, with an additional $500 million in support to Canada's automotive industry through the automotive innovation fund.

I'll give you an example of how this has worked thus far. Last year I announced a $72 million loan to transform Ford's Oakville assembly plant. Today that plant has the flexibility to produce 11 of Ford's high-volume, mid-sized vehicles, including the newly redesigned Ford Edge and the Lincoln MKX on one platform. This will make this plant one of only five Ford facilities capable of doing this work worldwide.

Sales have increased and are now 20% higher than they were during the recession. A recent report shows that our government is on the right track, with the Canadian manufacturing sector's revenue reaching almost $51 billion in the month of March—the highest it has been since 2008.

In conclusion, Mr. Chair, our government has promised Canadians that we would return to a balanced budget by 2015, and our government is working diligently to move forward with these measures and others to stand up for our consumers, to strengthen Canada's digital economy, and to boost our financial position through innovation and research. By focusing on these priorities that I've outlined here today, our government is delivering the results for Canadians, for which we asked the mandate to deliver on.

I would now be happy to answer any questions the committee members may have.

Thank you very much for your time.

I am looking forward to answering your questions.

[Peter MacKay, Conservative, Central Nova, NS]

My position is the consistent one, which is that I can only speak to legislation for which I have responsibility, particularly a bill like Bill S-4 that has not passed into law. But is there an interaction? Is there a causal connection? By all means.

[Sean Casey, Liberal, Charlottetown, PE]

The last time you came before committee, we were talking about Bill C-13. You and your officials were either reluctant or outright refused to talk about the interaction between Bill C-13 and Bill S-4. I trust that you've had an opportunity to review the testimony of a fellow Nova Scotian, David Fraser, on this topic.

Is it still your position, Mr. Minister, that there is no relationship between the bill that's presently before the Senate with respect to online privacy and Bill C-13, the so-called cyberbullying legislation?

[David Fraser]

The legislation is intimately connected. The three-quarters of this bill that we have in front of us relates to, in most cases, telecommunication service providers handing over information to the police and the circumstances under which the police can request it and demand it, and then this immunity that actually bestows on those telecommunication providers rights.

That's one-half of a coin, where the other half is regulated by PIPEDA, the Personal Information Protection and Electronic Documents Act. So you have two forces at play, and they are in fact intertwined. So hopefully, when Bill S-4 is being reviewed, they will, in fact.... Although, from what I understand, the minister and the justice officials were not willing to talk about that.

At every part of the PIPEDA review process, which Bill S-4 is the culmination of, Department of Justice lawyers were there acting on behalf of public safety and acting on behalf of others, particularly when it came to the provisions in subsection 7(3), and I would really hate.... Because they interlock together, if you look at this gear in isolation from that gear, you're not going to see how they actually play together, and that needs to be subject to some thorough discussion.

[Sean Casey, Liberal, Charlottetown, PE]

Thank you, Mr. Chair.

I want to go back to you, Mr. Fraser. On Thursday we had the minister and some officials come before the committee. They were either reticent or outright refused to talk about the relationship between Bill S-4 and Bill C-13.

Why should the minister, why should his officials, and why should we care about the relationship between Bill S-4 and Bill C-13?

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

I think it was the Privacy Commissioner who might have been in front of the Senate on Bill S-4.

I had a chance to look at her testimony, so I'm wondering if the analysts could maybe just forward a copy or a link to her testimony so we could review that.

If it's amenable to the committee, then, not right now, but we'll expand our witness list on identity theft and perhaps increase the study; I would even suggest more than four meetings.

So perhaps that is acceptable.

[David Fraser]

Thank you very much, and thanks for asking me those two particular questions.

In our Canadian criminal law, there are a number of circumstances where law enforcement agents can go to a justice of the peace or a judge and they have to satisfy whatever that burden of proof is in order to get some sort of compulsory instrument, which can be a wiretap order, or it could be a search warrant or a production order.

There are different thresholds for those. It generally depends upon the intrusiveness of the measure. Something like a search warrant to enter your house—for law enforcement agents to be authorized to, for example, break down your door—they have to have a very high standard of understanding. They're doing this on good information, very reliable information that they have reasonable grounds to believe—not just suspect, not just think—that a crime has been, is being, or will be committed and that the order is necessary in order to get that information.

In other sorts of compulsory processes, the standard is going to be lower on the understanding that the nature of the information being obtained is less intrusive. There's a difference between going into somebody's bedroom and going into their safety deposit box at a bank, for example. It recognizes that discretion.

What I was suggesting with respect to this transmission data recorder is to recognize that if it's fine, and the courts have upheld reasonable grounds to suspect, for telephony metadata, telephony signalling data, I don't think, because of the different nature of the information, that this reasonable grounds to suspect is appropriate.

As well, it might not actually survive court scrutiny because of the nature of the information that's being disclosed. It's never, in these sorts of circumstances, simply a matter of black and white. You end up in shades of grey.

The second question that you asked and I'm grateful for was the question related to immunity, and particularly you flagged the issue with respect to the charter. It takes two to tango in this sort of circumstance where the law enforcement officer would go to the telecommunications service provider and ask for the information. Under the Criminal Code, it's fine. Police can ask for anything; whether they're lawfully entitled to compel it, they can ask for anything from anybody. They're asking for the telecommunications service provider to voluntarily hand over that information.

The telecommunications service provider really doesn't care about the charter in terms of informing their decision-making. The charter applies to the police officers. It applies to whether or not the evidence that's gathered will be admissible in court, but the telecommunications company isn't involved.

So they're going to ask themselves a couple of questions. Am I legally able to hand this over? Am I legally prohibited from handing this over? And is there any civil liability that I could incur?

So one of the challenges we have is this. We don't have it in front of us, but Bill S-4 is going to amend PIPEDA, the Personal Information Protection and Electronic Documents Act, and in particular paragraph 7(3)(c.1), which is currently being reviewed by the Supreme Court of Canada with respect to whether or not, and under what circumstances, Internet service providers can hand over customer information on a non-warranted, non-judicially authorized request.

I understand that certain Canadian telecommunications companies do hand over that sort of information without a warrant. Their decision-making has been guided by the reading of an extremely ambiguous portion of that act, which allows a company—because we know the police can ask anything—to disclose information without consent to a law enforcement agency if they say—it's not under oath, it's not verified—that it relates to an investigation of a contravention of the laws of Canada or province, or a breach of an agreement, and they've identified their lawful authority to obtain the information.

So what the Supreme Court of Canada is considering is this question of lawful authority. Some telcos and police agencies take the view that simply policing duties is lawful authority to obtain the information. Others take the view that it's not sufficient. Lawful authority needs to be something else, something that is compulsory.

Some telcos err on the side of caution. Some err on the side of handing over information to the police agencies. But when they're asking themselves whether or not they should do that, in the background is also whether or not they could be sued for it. Handing over information where they're legally not compelled to, but there's a privacy law and a privacy interest at stake, could amount to something called an intrusion upon seclusion, which the Ontario Court of Appeal said you're entitled to damages for if that happens.

So I think what's happening here is that this provision has been put in here in order to make sure, in order to take that out of the equation—

[David Fraser, Partner, McInnes Cooper, As an Individual]

Thank you very much.

Thank you very much for providing me with the opportunity to speak with you and the committee today.

For the purposes of introduction, my name is David Fraser. I'm a partner with the Atlantic Canadian law firm McInnes Cooper, but I do need to emphasize that I'm here speaking as an individual. My comments and opinions shouldn't be attributed to my firm or its clients or other organizations with which I'm associated.

I've been practising Internet and privacy law for over a dozen years now. I've represented a range of clients over the years, including victims of cyberbullying, victims whose intimate images have been posted online, and I have represented and advised service providers.

Most notably, I was part of a team at my firm that took the case of a 15-year-old girl, a victim of cyberbullying, to the Supreme Court of Canada. This was the first time that the court had the opportunity to consider the phenomenon of cyberbullying, and the unanimous court came out very strongly to protect the interests of this victim of sexualized cyberbullying. But I've also advised people who have been accused of cyberbullying, and I hope that this experience from a number of different perspectives will provide this committee with some assistance in its very important task of considering Bill C-13.

First, looking at the bill as a whole, I'm disappointed that Bill C-13 combines two very different but related matters: the dissemination of intimate images on one hand, and law enforcement powers more generally on the other hand. Both aspects raise very important issues that merit close scrutiny, but we're seeing the debate about police powers as overshadowing the discussion about cyberbullying. That said, we do have one bill in front of us and I'm pleased to provide you with my thoughts.

It has been suggested that Bill C-13, if it had been enforced, could have saved Amanda Todd and Rehtaeh Parsons and other young people. That makes a good sound bite, but the world is much more complicated than that. The creation, possession, and dissemination of child pornography is and was a crime. So is the creation, possession, and dissemination of voyeurism images. So is extortion. So is criminal harassment. So is sexual assault. But that said, there is a gap that we should fill, which is the malicious dissemination of intimate images without the consent of the person depicted in them, regardless of the age of the person depicted in the image.

We need to be very careful about how we craft this offence, however. The current reality is that young people and adults, whether we like it not, take photos of themselves and voluntarily share them with intimate partners. Those digital images can easily be spread around without the consent of the person depicted. We want to criminalize the boyfriend who posts pictures of his ex-girlfriend online without her consent, the so-called revenge porn. We want to criminalize the actions of the person who forwards around images of current or former intimate partners. In each of those cases, the individual would know, or ought to have known, whether they had the consent of the person depicted in those images.

But we need to be cautious. We shouldn't inadvertently criminalize behaviour that's not blameworthy. Someone finds a picture online of someone naked—I understand there are pictures of naked people on the Internet—and forwards it to a friend. That person knows nothing about the circumstances in which the photo was taken. It could be a professional model. The photo could have been posted by the person in the photo herself. There's no way to tell whether consent was obtained, whether there was any expectation of privacy at the time that the image was created, and the individual, in this case the accused, would have no way of determining this, would have no way of contacting the person in the image to find out. So the real challenge arises when addressing third parties who do not know the person depicted in the image, nor do they have knowledge of those circumstances in order to figure it out.

The provisions in the bill use a recklessness standard, which in my view is too low. Recklessness applies where a person should have looked into it but decided to be wilfully blind. However, given the huge number of images online, it's not possible to look into it. This is especially important for online service providers, who have no way of knowing and no way of finding out the circumstances under which an image was taken or uploaded. We need to be especially attentive to crafting the law so that it will survive a challenge in the courts, and recklessness poses a risk of having a law struck down or making criminals out of people who are not truly blameworthy.

Turning now to the part of the bill related to police powers, the first one that I'd like to speak about is transmission data. Bill C-13 creates a production order for transmission data and warrants for transmission data recorders. It has been said that the purpose of the transmission data provisions of the bill is to extend the current police powers—which are coupled with judicial oversight, I'm very pleased to see—related to telephone information and move that over to the Internet age, the idea being without significantly altering the status quo, simply altering or modernizing what's already an existing police power.

While this may be a very reasonable objective, this must be done also very carefully, because transmission data in the Internet age is very different from transmission data in the traditional plain old telephone system. With conventional telephony, transmission data refers to the number called from, the number called to, whether the call was connected, and how long that call lasted.

In the Internet context, the amount of information that's included in the kind of out-of-band signalling information and what it reveals is dramatically different. It would include the IP address of the originating computer, the destination computer, information about the browser that's being used, information about the computer that's being used, information about the URL, the address being accessed, which can actually disclose content, even though the definition of transmission data is intended to exclude that.

It will also tell you what kind of communications are being done. Is it an e-mail communication? Is it an instant message? Is it peer-to-peer file sharing or otherwise? So it provides much more insight into actually what is going on than just phone number information.

An interception of transmission data would tell law enforcement agencies whether the target of surveillance was visiting a search engine, an encyclopedia site, a poker site, or a medical site. Furthermore, the data would provide greater insight into the likely physical location of the surveillance target. This is a dramatic expansion of the information that's provided and available, compared to traditional telephone communications.

As anybody in this room knows, I expect, the way we use computers today is dramatically different from the way we used telephones 15 years ago. We use them as spellcheckers. We use them to find out facts. We use them for a much wider range of activities. With the disclosure of greater information through these transmission data orders, you're revealing much more about an individual. Even though the definition excludes content, just the transmission data tells you a lot more about really what's going on.

I would suggest this can be fixed by either raising the standard from reasonable grounds to suspect to reasonable grounds to believe with respect to this data, or re-crafting the definition of transmission data, so we're sure that we are, in fact, paralleling what is intended, which is to take the telephony tool and move that into the modern Internet age.

I would also note that in all of these orders—again, I'm pleased that they're subject to judicial oversight and judicial approval—there is no mechanism in these for notifying the individual after the fact that their information has been accessed, which I think is something that happens with respect to wiretap orders. Certainly it happens with respect to search warrants. I believe that should be extended into this environment as well for these sorts of production orders.

Finally, I would touch very briefly on the issue of service provider immunity that's touched on within this statute. I find this to be gravely problematic. I think it's a very cleverly crafted provision. We're told that this is simply for greater certainty, but it goes beyond that. Everything we know suggests otherwise.

It says that you will not be liable for handing over any data that you're not prohibited by law from handing over, and if you do so you're civilly immune. Now, only the criminal law and other regulations create prohibitions against handing over information, but you can hand over information when you're not legally prohibited and still incur civil liability. Civil liability is there for a reason. I may not be legally prohibited from accidentally driving my car into yours, but if I do that, you're entitled to damages from that. I should be paying for the harm that is caused.

If there were an immunity provision that said you could not sue me if I did something that was not legally prohibited, that would be squelched. That would go away. So this provision, I believe, should be removed. It can't be fixed and will only encourage overreaching by law enforcement.

In conclusion, while we don't have Bill S-4, the digital privacy act, in front of us, that fits together with the immunity provisions. I'm concerned that the two taken together will extend the amount of information not only available to law enforcement but will extend the information available to other civil litigants and others. Although I understand it's not within the jurisdiction of this committee, I flag the fact that Bill C-13 and Bill S-4 do, in fact, fit together, and somebody should look at that interrelationship.

Thank you very much for this opportunity to speak with you today. The cyberbullying provisions are an important step forward and will, if properly tweaked, address this very serious problem. The rest of the bill needs to be very closely examined to ensure that it does what it is supposed to do and nothing more. It should be about providing the police with appropriate tools, with adequate thresholds and accountability, and judicial oversight, but not redrawing the line with respect to personal privacy.

I very much look forward to discussing this issue with you further. Thank you.

Safeguarding of Personal Information

[Françoise Boivin, NDP, Gatineau, QC]

Mr. Speaker, I am pleased to conclude the debate on the opposition motion.

I will read the motion, because after hearing such garbage today, I was beginning to think that I was not talking about the right one. This is what the motion, moved by the hon. member for Terrebonne—Blainville, is asking of the House:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

I cannot believe that today, May 5, 2014, the Conservatives are going to vote against this motion. It is absolutely incredible. We heard all sorts of drama from the Conservatives about extremely important security issues. They shifted the debate from the opposition motion, which simply calls on the government to grant the Privacy Commissioner's request and make certain information public. It seems quite reasonable to me.

Today is the best possible day to be in the House. This morning, we debated Bill C-567, which was introduced by my colleague from Winnipeg Centre and is all about access to information. This motion is completely justified in light of the context, but they are saying all kinds of things.

I would like to comment on a question that my colleague from Timmins—James Bay asked the last Conservative member who spoke. That member laughed in his face even though the question was completely relevant. It was about peace officers, not as the local paper defines them, but as the Criminal Code defines them.

I would like to give my colleagues opposite a little lesson about the Criminal Code. It is important to define the notion of “peace officer” accurately, because Bill C-13, the government's supposed cyberbullying bill, refers to that notion. That bill is about much more than cyberbullying and the distribution of intimate images.

According to section 2 of the Criminal Code, a peace officer includes:

(a) a mayor, warden, reeve, sheriff, deputy sheriff, sheriff’s officer and justice of the peace,

(b) a member of the Correctional Service of Canada who is designated as a peace officer pursuant to Part I of the Corrections and Conditional Release Act, and a warden, deputy warden, instructor, keeper, jailer, guard and any other officer or permanent employee of a prison other than a penitentiary as defined in Part I of the Corrections and Conditional Release Act,

(c) a police officer, police constable, bailiff, constable, or other person employed for the preservation and maintenance of the public peace or for the service or execution of civil process,

(c.1) a designated officer as defined in section 2 of the Integrated Cross-border Law Enforcement Operations Act, when

(i) participating in an integrated cross-border operation, as defined in section 2 of that Act, or

(ii) engaging in an activity incidental to such an operation, including travel for the purpose of participating in the operation and appearances in court arising from the operation,

(d) an officer within the meaning of the Customs Act [or] the Excise Act...or a person having the powers of such an officer...

I could keep reading this definition until 6:15 p.m. It is not so far-fetched for my colleague from Timmins—James Bay to suggest that Mayor Ford could request certain information.

What is more, the NDP has been heavily criticized today for some of its requests. However, in La Presse this morning, there was an article by Joël-Denis Bellavance on the information we are looking for with the official opposition motion moved by my colleague from Terrebonne—Blainville. Mr. Bellavance reported that the Privy Council Office also made a request of all its departments. The PCO wanted to know who these people were who made 1.2 million requests for information about Canadians. There are 1.2 million Canadians who are allegedly affected by these requests.

All day, the Conservatives have been telling us that this is terrible, that what we are asking for is scary and that the NDP does not know what it is talking about.

I even heard one of the ministers of state, a junior minister over there, say the times have changed.

I think we all know that. Information circulates quickly, I agree. Regardless of the fact that times have changed, there are still laws that apply in this country.

We all know that this Conservative government likes to intrude on Canadian taxpayers' privacy and could not care less about almost every law around. When this government gets caught, it takes a holier than thou stance or it suddenly takes a few strategic steps backward and comes back with what I like to call the Trojan Horse tactic. In other words, it disguises its approach in another way.

Everyone in the House remembers Bill C-30, introduced by my favourite minister, the former minister of public safety. I was going to say something unkind, but I will be careful. Thank God the public woke up and made a concerted effort to ensure that the government backed down. This goes to show that ridicule never killed anyone. However, sometimes it kills political careers, even though politicians will often end up becoming a judge somewhere. Everyone kept telling the former public safety minister what he was in the process of doing. They ridiculed his bill. Sometimes that is what it takes with this government.

Their concerns were heard. The Conservatives withdrew the bill and suddenly we had Bill S-4 and Bill C-13, which deals with cyberbullying. Who in the House would not want to protect victims? Who would not want to say at some point that we passed legislation after a number of young people committed suicide as a result of bullying? That is rather disgusting, although there are other unparliamentary words that could be used. It is problematic to rise in the House and say that, on the contrary, we are in favour of cyberbullying. However, once again, the Conservatives introduced five or six pages of text that were more or less accurate and then combined them with tons of provisions that amend all sorts of legislation.

Fortunately, the Minister of Justice told me that he would give the Standing Committee on Justice and Human Rights the time needed to examine those provisions. Perhaps we, the members of that committee, are not the best people to examine those provisions. Fortunately, we will be hearing from many experts.

I still believe that the motion that I moved at the beginning of the debate on Bill C-13 made complete sense. I proposed dividing the bill in two so that that we could do what we do best: examine the provisions of the Criminal Code and make sure that the new provisions regarding the distribution of intimate images fall within the parameters and meet the test of the Criminal Code.

Instead, we are going to be spending a lot of our time looking at the aspects of the bill dealing with privacy and how certain telecommunications providers will be able to disclose information without a warrant, or with a warrant but with a lighter burden of proof, and so on.

Unfortunately, since the beginning, this government has shown us that it has no credibility. Every week, there is a new drama featuring one of the people sitting in the front benches. At the end of last week—and it has continued into this week—it was the Prime Minister and his serious insinuations. Sometimes, not saying enough is the same as saying too much. He attacked the Chief Justice of the Supreme Court of Canada.

Members on the Conservative benches are wondering why we do not trust them. Why are we suspicious when we get bills like Bill S-4 or Bill C-13? We are wondering what is behind those bills.

People have been debating this motion all day in the House. I repeat that it does not get any simpler than this motion, which calls on the government to follow the advice of the Privacy Commissioner. Who does not want to follow that advice? Who is against making public the number of disclosures, when even the Prime Minister's Office is quietly checking into this matter? The Conservatives are simply afraid of doing things. They want public information on our constituents, on Canadian taxpayers, but they do not want anyone other than themselves to have access to that information.

That is why the government does so much behind closed doors. The representatives of the people, here in the House, certainly have a right to know. We are getting questions as well. I hear from people, and I am sure that my colleagues in the House, even on the Conservative side, are hearing from people. I am shocked to see that many of these people, from the Reform Party of Canada and the Canadian Alliance, who made a point of calling themselves the voice of the people, are now the biggest puppets, sitting in their seats, terrified to rise and say that this makes absolutely no sense.

At some point we need to wake up and go back to our ridings to talk to our constituents, who are asking what is going on with their information, who has access to this information, when and why. Are there 1.2 million criminals somewhere in Canada? Is it because we have relaxed our rules so much that everyone—ISPs, telecommunications companies and others—feels justified in passing on information? The companies know that they will go unpunished if they freely share information on anything. That is dangerous.

Some people here in the House say that times have changed. That is true. I can do research. In fact, I do not claim to know all the sections of the Criminal Code, and I was able to find the section on the concept of peace officer right away, in two seconds. It was actually quicker than that as I think it took me one-tenth of a second to find the definition in the Criminal Code. Sometimes I tell young people or future lawyers that they are lucky because, in my day—I do not like to say this because it dates me, but it is a fact—when I did my research, I had to go to the law faculty library and open maybe 18 books before formulating an idea. Now, we just click on a button.

However, just because information travels at astronomical speeds, it does not mean that the privacy guarantees and protections granted to all Canadians under the Charter of Rights and Freedoms must be trampled by a government that does not care about protecting its citizens.

[Colin Carrie, Conservative, Parliamentary Secretary to the Minister of the Environment]

Mr. Speaker, our government is committed to promoting the interests of Canadian consumers and the protection of their private information.

In an increasingly digital world, it is important that we have strong privacy protections in place to ensure organizations are treating the private information of Canadians appropriately. Many of these protections are already found in the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.

However, a lot has changed in the more than 13 years since PIPEDA came into effect. Our government is taking important steps to ensure organizations are accountable for how they handle the personal information of their clients and customers in today's digital world.

That is why on April 8, we tabled Bill S-4, the digital privacy act. The bill introduces new measures to update our private sector privacy legislation, which sets out specific rules that businesses and organizations must follow whenever Canadians' personal information is lost or stolen.

Recently, we have seen a disturbing example of this problem south of the border with Target Corporation. Just before Christmas last year, Target learned that malicious software had been installed on the company's computer systems, allowing the personal information of some 70 million customers to be stolen, including 40 million payment card records.

It is because of situations like these that we must continue to ensure Canadians' personal information is safe. Data breaches can happen in many different ways and to any type of organization, large or small. Data breaches can result from improper disposal, for example, of paper documents sent for recycling instead of shredding or computers resold without scrubbing hard drives clean, or it can be stolen through sophisticated cyber attacks like those experienced by Target.

Unfortunately, this is a growing problem. Last year saw an all-time high for the number of data records lost or stolen worldwide. The Verizon data breach investigations report estimated that in 2012 between 575 million and 822 million records were compromised in data breaches.

We know that cybercrime is a growing problem in Canada. Last October a study reported that cybercrime cost Canadians some $3 billion over 12 months, up from $1.4 billion the previous year.

That is why our government has already put a number of significant measures in place to combat cybercrime and protect our digital infrastructure, such as Canada's cyber security strategy. In addition to this, Canada's anti-spam law will begin to come into force July 1, later this year. This law will help Canadians deal with unwanted commercial emails, and will also protect Canadians from cyber threats, like malware and fraudulent websites that seek to steal their personal information.

These measures are significant, but more is needed. We must ensure organizations have strong incentives in place to implement strong data security. Currently in PIPEDA there is no obligation for businesses and organizations to inform customers and clients when their personal information has been lost or stolen. This means if a company loses people's credit card information, that company is not obligated to tell them. With the digital privacy act, our government is proposing to correct this.

Stolen data can be used to create false identities that are used in criminal activities. They can be used to hack onto online banking services. In the wrong hands, lost or stolen health information, employee records, even criminal records can create countless problems to those who have had their personal information compromised.

I also want to state, Mr. Speaker, that I will be splitting my time with the member for Desnethé—Missinippi—Churchill River.

We believe it is up to all organizations to put in place the safeguards to protect the personal data they have collected from their clients and customers. This is a responsibility that most take very seriously. However, with the changes we have proposed, if a company has its computer systems hacked and believes personal information has been stolen or if that information has been lost inadvertently, the company will need to take a number of steps.

If the company determines that the breach poses a risk or harm to individuals, it will need to notify the Canadians affected and make a report to the Privacy Commissioner of Canada. Organizations will also be required to document and keep a record of the event, including the result of its risk assessment. This would be required for every breach, even if the company did not think the breach was harmful. The organization would have to provide these records to the commissioner upon request, providing oversight and holding organizations accountable.

Let me provide an example. Say that an organization determines that a laptop containing customer personal information has been lost. It will be required to make a record of this loss. If the breach involves unencrypted sensitive personal information such as credit card numbers, other financial or health information, for example, it would pose a real risk and potential significant harm to those involved. As a result, the organization would be required by law to notify the customers who were impacted.

The company would be not only required to tell customers when it lost information, it would also be required to report the loss to the Privacy Commissioner. The commissioner may then request a copy of the company's records to see if there is a history of similar losses that would be a cause for concern. The Privacy Commissioner would then have the option of opening an investigation into the matter.

It should be clear to all members in the House that implementing a requirement for mandatory data breach notification is a significant improvement to our private sector privacy laws. Our government believes there needs to be serious consequences for any organization that deliberately breaks the rules and intentionally attempts to cover up data breach. The changes that our government has proposed will also make covering up a data breach an offence. In cases of deliberate wrongdoing, an organization could face fines of up to $100,000. To be clear, it will be a separate offence for every person and organization that is deliberately not notified of a potential harmful data breach and each offence will be subject to a maximum $100,000 fine.

The digital privacy act would address the concerns posed by data breaches and has received good reception so far. In fact, the Privacy Commissioner commented that she welcomed the proposals in this bill. She said that it contained very positive developments for the privacy rights of Canadians. Even the member opposite for Terrebonne—Blainville said, “We have been pushing for these measures and I'm happy to see them introduced. Overall, these are good...steps”.

Our government has taken a balanced approach to the responsibilities placed on businesses and organizations, while protecting Canadian consumers by giving individuals the information they need to protect themselves when their information has been lost or stolen. The digital privacy act demonstrates our government's commitment to providing Canadians with the confidence that their privacy and personal information are protected.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I listened with great interest to my hon. colleague.

It has been fascinating listening to the Conservatives, because in their upside-down world, they are opening the door to widespread snooping and spying on Canadians but are somehow protecting their privacy.

I ask my hon. colleague about what we are reading in the National Post about the government's supposed fix, Bill C-13. We have been hearing from their tough-on-crime guys. It is all about the police investigation and the importance of investigation. We need to be able to investigate and go after the crooks, the perverts, and the crazy terrorists. However, under Bill C-13, the Conservatives' fix would take out the provision, the caveat, that enforcement agencies would actually have to be doing an investigation. It would no longer be for investigating crime but for anything that would help in “administering any law in Canada”.

It is the ultimate free ride for fishing expeditions, not just for law enforcement but for corporations. Under Bill S-4, corporations could demand information on our Internet use, as could public officers, which include, if we look up the definition, reeves, mayors, and even people who work for the Department of Fisheries, fisheries officers.

I would like to ask my hon. colleague why he thinks the government is so intent on changing the law to allow widespread snooping. Is it possibly because this is what the standard practice has become under the Conservatives' watch?

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I am very pleased to stand in the House this afternoon in support of the motion by my colleague, the MP for Terrebonne—Blainville, on this great opposition day.

It is a day in the House to be talking about privacy issues. This morning I had the privilege of speaking in support of Bill C-567, an act to amend the Access to Information Act (transparency and duty to document), put forward by my colleague from Winnipeg Centre.

This morning's bill and this afternoon's motion complement each other very well. Together they demonstrate to Canadians our NDP desire that it be the citizens of this country, not the government of this country, who are able to conduct their lives with a reasonable expectation of privacy and that it be the government of this country, not its citizens, that has the obligation to operate in a manner that is transparent, open, and accountable.

If there is a simple conclusion to draw from the sum of the whole day, it is that the current Conservative government has it backwards, upside down, and twisted all around. The Conservatives stand in support of government privacy, of, in fact, the necessity to operate free from the scrutiny of the citizenry of Canada and those they elect to hold the government accountable.

How, the Conservatives ask in response to Bill C-567, can they operate at once openly and honestly? If they are to tell the truth, it must be behind the curtain, they argue, in the dark, out of earshot, and away from the gaze of the public and opposition members of this place. On the other hand, they demonstrate no mere disregard of the privacy rights of Canadian citizens. They demonstrate an appetite, a voracious, seemingly insatiable appetite, for the private information of Canadians.

Much is made of the fact that we live in new and different times, with new forms of information and new means of accessing that information. There is truth, of course, to this, undeniably. I think all of us are alive to the ease with which information we consider private is accessible to those who want to put some effort, and not much is required, into accessing it. Our expectation of privacy is diminished as a result, simply because we know the ease with which we are vulnerable. Therefore, we see the narrative here being one of the need to modernize our laws to take these new circumstances into account. That does not account for the conduct of the current government.

The problem before us is not simply one of a government that has not come up to speed, that has failed to respond in a timely way to these new circumstances, and that has left exposed loopholes in the formulation of the laws of this country. That would paint a picture of an incompetent or slow, but certainly benign, government. No, the current Conservative government is anything but benign.

Confronted with a loophole for accessing the private information of Canadians, a benign government may simply fail to close that loophole. The current government lets through that loophole, fully, completely, and head first, with great enthusiasm and an obvious lust for what it might find on the other side. What we have before us is evidence of this lust.

Very recently, the Privacy Commissioner of Canada, Chantal Bernier, revealed that Canadian telecom companies disclosed massive volumes of information to government agencies, including the Royal Canadian Mounted Police, the Canadian Security Intelligence Service, Canada Border Services Agency, and provincial and municipal authorities.

Telecom companies disclosed personal data to the Canadian government 1.2 million times in a single year. We can of course concede that a balance is to be found between privacy rights, public security, and other concerns, including immediate danger to life. However, this can be nothing other than an indiscriminate fishing expedition of monumental proportions that the Privacy Commissioner has revealed to us.

These volumes equate to information requests with respect to one in every 34 or so Canadians. The vast majority of these requests are made without warrants. These volumes equate to a request for personal data, by the federal government to a telecom company, once every 27 seconds.

So great is the volume of information requests that one telecom company has advised that it has installed what it calls “a mirror” on its network so that it can send raw data traffic directly to federal authorities. Michael Geist, a digital law professor at the University of Ottawa, says this of what is happening:

This is happening on a massive scale and rather than the government taking a step back and asking is this appropriate...we instead have a government going in exactly the opposite direction—in a sense doubling down on these disclosures

It is easy to find further evidence of this doubling down, of this appetite for private information. One cannot help but note that Bill C-13, which is purportedly about cyberbullying, is more about lowering the bar on government access to information. The “reason to believe” standard is being replaced with a “reason to suspect” standard, opening up much greater warrantless access to electronic information. Moreover, Bill C-13 would allow a broader and lower range of government officials to have access to the private information of Canadians.

Bill S-4 will also be coming before this House, we suspect. That bill would permit non-governmental organizations and corporations to have access to information from telecom companies. FATCA, the Foreign Account Tax Compliance Act, buried deep in the budget bill, would expose the financial information of about one million Canadians to the U.S. government, and so on.

In light of all of this, one could argue that there is a kind of naiveté to the motion I speak in support of today. Certainly the first part of the motion is easy enough. It is, in fact, all the Privacy Commissioner has requested. She has said:

I'm not disputing that there are times when there is no time to get a warrant—life is in danger....

What we would like is for those warrantless disclosures to simply be represented in statistics so that Canadians have an idea of the scope of the phenomenon.

...It would give a form of oversight by empowering citizens to see what the scope of the phenomenon is.

It is a modest enough proposal: at least let me see what it is the federal government is doing here.

However, we are also asking the government to close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without warrants. In so doing, we must recognize that we are asking the predator to restrain itself, to bind itself, to limit its own appetite for our private information, to guard itself. It has no such impulse, no such sense of constraint, as is obvious from the 1.2 million requests, by Bill C-13, by Bill S-4, and by FATCA.

Here is the very saddest part of this. As we engage with each other through the technologies of this modern world, we do so with some trepidation about how exposed we are to the prying eyes and interests of others, and part of what we need to be concerned about now, we find out, are the prying eyes and interests of our own government. Rather than being able to rely on our own government to support us and to protect our privacy in this modern world, it appears that our government is itself a cause for concern.

[Don Davies, NDP, Vancouver Kingsway, BC]

Mr. Speaker, it is a pleasure to stand in support of the official opposition New Democratic motion introduced by our superb colleague, the member for Terrebonne—Blainville. I should point out that I will be sharing my time with my hon. colleague, the equally commendable member for Beaches—East York.

The motion before the House today reads as follows:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

If we think about those words, and I know Canadians will think about the text of the motion, who could possibly not support this? Who could possibly oppose a motion of the House of Commons in Canada that the government should simply tell the public how many warrantless disclosures are made by telecommunications companies at the federal government's request and close a loophole that allows the indiscriminate disclosure, meaning the improper disclosure, of personal information of law-abiding Canadians without a warrant?

I would have thought that every member of the House would stand in support of such a motion, a motion that preserves and protects the very elementary privacy rights and expectations of Canadians everywhere, but that is not the case, because Conservatives in the House do not support the motion.

I am going to talk about how the motion came to be.

In summary, the motion addresses what we now have learned are rampant requests to telecommunications companies in Canada by various government agencies for Canadians' private information, often—in fact, normally and mostly—without a warrant.

We are calling on the government to listen to the Privacy Commissioner, an independent officer of the House, to make public the number of requests disclosed by these companies, and to tighten the rules that allow it to happen.

This came out of an access to information request that determined that at least one Canadian telecom was giving the government unrestricted access to communications on its network, according to documents from Canada's Privacy Commissioner. The documents were obtained by University of Ottawa digital law Professor Michael Geist. He cited at that time an unnamed telecom firm as saying that it had allowed the government to essentially copy the communications data moving on its networks.

I quote Mr. Geist:

Interception of communications over data networks is accomplished by sending what is essentially a mirror image of the packet data as it transits to network of data nodes.

Then the Privacy Commissioner's document states:

This packet data is then sent directly to the agency who has obtained lawful access to the information. Deep packet inspection is then performed by the law enforcement agency for their purposes.

“Deep packet inspection” is a method of analyzing Internet traffic to determine the exact type of content. It can distinguish between emails, file-sharing and other types of internet communication, and can be used to build statistics about an internet user.

This statement appears in the document prepared by the law firm Gowling Lafleur Henderson for the Privacy Commissioner. It summarizes nine telecom firms' responses to questions about law enforcement access posed by the commissioner.

Mr. Geist called this “an incredible admission”.

He asks:

Are there legal grounds for these disclosures? Who is doing this?

He goes on to say later:

Given the uncertainty of the enormous privacy implications, the Privacy Commissioner of Canada is surely entitled to investigate this admission using her current powers under PIPEDA.

Documents subsequently released by the interim Privacy Commissioner, Chantal Bernier, revealed that the government made about 1.2 million requests for subscriber data about Canadians from Canadian telecoms in 2011 alone. Mr. Geist calculates that it works out to one request every 27 seconds, and the Privacy Commissioner's report showed that telecom firms complied with the requests at least 784,000 times.

This issue engages one of the most important values that mark our nation. It is a value that marks our democracy. It is cherished by Canadians, valued by Canadians, and expected by Canadians. That is the value of privacy.

The government exists to protect its citizens. It exists to safeguard our rights, our interests, and our opportunities, so when the government is actually found to be the source of secret requests to private firms to try to get private information about Canadians without their knowledge and without ever appearing before a judge in a court to demonstrate that the government has any lawful interest in that information, in my view that is a violation of the most fundamental precept and obligation of the government. That is what is happening under the watch of the Conservative government.

I want to go through a few facts here. Canadian telecommunications providers collect massive amounts of data about their subscribers. These are the firms that have been asked by the government's agencies to disclose that information to law enforcement agencies. In 2011, providers responded to almost 1.2 million requests, but the actual total is likely even greater, since only three of nine telecom companies told the commissioner's office how many times they granted the government's request for customer data.

In 2010, RCMP data showed that 94% of requests involving customer name and address information was provided voluntarily, without a warrant. The Canada Border Services Agency obtained customer data from telecom companies 19,000 times in one year, and it obtained a warrant in fewer than 200 of those cases. Significantly, one Canadian company has told officials that it has installed “what is essentially a mirror” on its network so that it can send raw data traffic directly to “federal authorities”.

The Privacy Act, which is meant to protect Canadians' privacy and keep the government accountable, has not been updated since 1983, before the Internet, Google, email, Facebook, and Twitter were even invented. PIPEDA, which protects Canadians' privacy in the private sector, has not been updated since 2000. Once again, that is before Facebook, Twitter, and social media had really taken off in our country.

I would think that if the government is really concerned about the values of privacy and protecting Canadians' rights, it would spend time in this place modernizing those acts and doing so in a way that is consistent with Canadians' expectations. Instead, it is doing the opposite. It has introduced Bill C-13, a bill that is expressed to be aimed at attacking cyberbullying, but which is expected to expand warrantless disclosures of Internet or cellular subscriber information to law enforcement.

Bill S-4, the digital privacy act, has been introduced in the Senate. It would also extend the authority to disclose subscriber information without a warrant to private organizations, and not just law enforcement agencies. It would also allow telecom companies to disclose the personal information of consumers without their consent and without a court order to any organization investigating a contractual breach or possible violation of a law.

There are many validators of the New Democratic position. New Democrats think privacy laws should be modernized and strengthened to better protect Canadians' personal information, not weakened. New Democrats believe that we can and should aggressively pursue criminals and punish them to the full extent of the law without treating law-abiding Canadians like criminals and violating their rights.

Privacy is something that must be judiciously and carefully guarded by every generation. We have people as diverse as Benjamin Franklin, who said that those who would give up liberty for a little security deserve neither. We have organizations as diverse as the Council of Canadians and the Canadian Taxpayers Federation, who are joining together in their concern about the issue of violations of privacy and surveillance of Canadians' private interests on the Internet by the government.

I say that what Canadians want of their federal government is for it to protect their privacy interests, not be complicit in violating them.

For the Conservative government to allow 1.2 million requests to go to telecoms for Canadians' personal information without their consent, without their knowledge, and without a court order is something that every Canadian in this land would disapprove of.

I ask all of my colleagues in the House to vote for this well-thought-out motion.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would like to point out one thing. We are not debating Bill S-4 right now. We are debating the opposition motion moved by the NDP, which specifically calls for transparency measures when it comes to the 1.2 million instances of disclosure of personal information. We are also asking that the government close the loophole in the legislation.

This really has nothing to do with Bill S-4. I am certain that we will have the opportunity to debate the bill and I will be pleased to participate in that debate, but now is not the time to do that.

[David Wilks, Conservative, Kootenay—Columbia, BC]

Mr. Speaker, It is a pleasure to rise today and highlight the measures our government is taking to protect the privacy of Canadians.

As members of this House are aware, the Personal Information Protection and Electronic Documents Act, PIPEDA, has been in force since 2001. I would like to focus my comments on one area in particular, and that is the role of the Privacy Commissioner of Canada in promoting compliance with PIPEDA and increasing accountability among organizations that collect, use, or disclose personal information.

First, let me begin with a bit of an explanation of how the act works when it comes to compliance. Under PIPEDA, the Privacy Commissioner serves as an ombudsperson. Individuals who feel their personal information has been improperly handled by an organization have the right to complain to her office.

The commissioner has the power to investigate, enter premises, compel evidence, mediate a settlement, make recommendations, and publish the names of those who contravene PIPEDA. In short, the privacy commissioner investigates complaints and works with companies to make sure they comply with the act for the protection of all Canadians. The commissioner has a range of powers, but as an ombudsperson, takes a co-operative and conciliatory approach wherever possible. This encourages the resolution of complaints through negotiation and persuasion.

At the conclusion of an investigation, the commissioner releases a report of findings that outlines whether or not the organization in question has contravened the act and whether or not the complaint was resolved. This report also includes notice of any action taken or proposed to be taken by the organization. It may also include reasons why no action was taken.

Under PIPEDA as it now stands, the commissioner or individuals can apply to the Federal Court for a hearing on any matter related to the original complaint within 45 days of the commissioner's report. The court has the authority to order the organization to change its practices. The Federal Court can also award damages to Canadians when their privacy has been violated and they have suffered from some form of harm as a result. That is how compliance currently works.

However, as technology has evolved, we as members of this House must ensure the commissioner is able to hold organizations more accountable for their handling of personal information for the protection of Canadians and their privacy. It is for that reason that our government has proposed increased power to enable the Privacy Commissioner to better do her job. It is clear from the remarks from the Privacy Commissioner of Canada that our government is on the right track.

Before our government tabled Bill S-4, she said, “I welcome proposals...” in this bill. This bill contains “...very positive developments for the privacy rights of Canadians”.

We work with the Privacy Commissioner of Canada, we protect the best interests of everyday Canadians and we make sure that we move forward to modernize our digital privacy laws. This is why we are proposing this bill, which includes three important changes to keep companies accountable when dealing with Canadians' personal information.

First, we want the commissioner to have the authority to negotiate compliance agreements.

Second, we want to extend the length of time the commissioner or individuals have to bring matters before the court. Instead of the very limited time of 45 days, we would extend that timeframe to one year.

Third, we want to give the commissioner greater power to name and shame organizations that are breaking the rules.

Let me describe each of these changes in a bit more detail.

Going to court to resolve a dispute can be costly both for the organizations implicated and the Office of the Privacy Commissioner.

A compliance agreement is a powerful tool that provides an alternative to taking an organization to court. These are voluntary but binding agreements between the commissioner and the organizations that recognize they need to take action to improve their privacy practices.

These agreements benefit both sides. They can provide an organization with certainty and clarity about what specific steps they need to take, and a specific timeline to ensure they are compliant with the rules. These binding agreements also give the organization the certainty that it will not face court action by the commissioner—

[Mike Wallace, Conservative, Burlington, ON]

Mr. Speaker, I want to first of all thank the Parliamentary Secretary to the Minister of Public Safety and Emergency Preparedness for sharing her time today. She gave an excellent speech on this topic and it is an honour for me to speak to this issue. I appreciate the New Democratic Party using its supply day that provides opposition parties an opportunity in every session a number of days to put forward any items they would like for discussion.

Frankly, in the past some of the topics that have been brought forward on supply days I thought were very much a waste of important time that the opposition is allotted. However, in this case it is important. It is in the news. It is something that has been happening in terms of information that is out there and it is important for us to have a debate on this and discuss what the facts are in this case and going forward.

There is an important balance required between privacy and the ability of law enforcement, in particular, to be able to do their jobs. The Conservatives have has put in around 30 measures since we have taken office to improve issues with privacy and access to information regarding this and it is always important to have a balance.

There have been a few misconceptions propagated in the press or in the House and connections with what was in the newspaper and Bill S-4 in the Senate that talks about PIPEDA and a number of other areas, but I want to focus on what is in front of us today. The main question is what type of information our law enforcement and intelligence agencies are requesting from telecommunications service providers.

The vast majority of those investigations were agencies requesting voluntary co-operation. Before we go any further, it is voluntary co-operation. They ask and the service providers provide. They are not providing all the content of what an individual may be using or looking at through their IPS or service provider, whether it is a cellphone or the Internet, but they are providing basic address information such as name and address.

A simple example would be this. The police could look in the phone book. They know where I live. I know who is on my street. I have lived there for 16 years. Police might come to my door and ask if so-and-so lives next door. I have to say “yes”. I voluntarily provide that information and that is basically what has been asked for. I do not give the police permission to go into my neighbour's mailbox, open their mail, and read their mail. That is not the permission we are providing and that is being accessed here.

I would not expect the police or anyone else to be able to go into my mailbox in my house. I am happy for them to come to my door to find me. I think that is information that has been out there for many moons, but they are not entitled to go into my mailbox and read my mail. They can if they get a warrant through the judicial system that allows that to happen. That is exactly what is happening here.

The world is changing. In the late eighties, early nineties, I worked for a company and I had what was called a car phone. It was on a post attached to the floor of my car. At that time, there were few of us who had them, but times have changed. Now 21 million Canadians have access to a cellphone, they are texting and it is a different type of communication. There is no reason why we, as the government or the police force or intelligence agency, should not be able to keep up with the times. How are we going to do our jobs if we do not keep up with the times?

Many of my constituents think that government is always behind the times, and some days here I actually agree with them.

However, it is not about the content of this information that is voluntarily being provided. If a company decides that it does not wish to provide it on a voluntary basis, then the police force, intelligence agency, or whoever is asking for it, is required to go and get a warrant or whatever legal document they need through the legal system to be able to have access to that information. I have no particular issue with this. Does any of this information require a warrant? Not if it is voluntarily provided.

I would say that if there is any further detail about exactly what somebody is accessing through their email, who they are emailing and all of that larger data, even as it is grouped, is not allowed. One needs a warrant for that particular information. Megadata is not covered in the voluntary aspect of those requests and they would still need a warrant.

I think members will find that the information that has been asked for and voluntarily provided is very simple address information. The parliamentary secretary indicated a number of uses for that information, and I think that is appropriate.

I can say that if I had a loved one who was missing or recently found and officials were able to contact me because they were able to find, through who they were dealing with, my phone number so they could let me know that they had found this individual, I would be very happy for the police to do that.

I had my home broken into a number of years ago and we had some property stolen. We voluntarily provided the police information to contact us if they were able to find some of our stolen goods. In fact, the police did. They found it at a pawn shop and they contacted us. They were also able to track down the individual who was in our home and prosecute the individual for the crime against us.

This is the kind of information that is now available and required. It is address information that happens to be in an electronic format. It is not on paper any more. It is not a phone book on paper, but in an electronic format, and officials are able to use that.

The justice committee that I chair is presently looking at a cyberbullying bill, Bill C-13. We are just embarking on that study and as of tomorrow we will hear from victims of cyberbullying. We will also hear from police forces and agencies that protect children. I will be interested to find out how they feel about basic address information being provided to law enforcement organizations to help prevent this kind of abuse and tragedy that happens to our young people throughout the country.

I have great faith and trust in our law enforcement agencies, as I think all of us do in this House. I am confident that our law enforcement agencies are following the law that is on the books presently. They are gathering information that they are entitled to, which is given voluntarily to help them solve crimes. For information that is deeper and more informative that they need, they will get the proper legal documentation, whether that is a warrant or other devices available to them. I have confidence in our system.

I have confidence in our law enforcement agencies. I believe it is important to balance the issues of privacy and protection of the public. I believe our law enforcement and intelligence agencies do an excellent job for Canadians.

[Roxanne James, Conservative, Scarborough Centre, ON]

Mr. Speaker, I have to first address the speaking from the two sides of the mouth. The New Democrats have put this motion forward today, but the very same member who moved the motion said they were pleased with the measures in Bill S-4. Therefore, we need to clarify who is speaking out of both sides of their mouths.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I listened to my hon. colleague with interest, and a little surprise. This is a government that seems to be talking out of the both sides of its mouth. It first says it is just basic data that anyone can get in a phone book but that we need to do it immediately to stop all kinds of terrorist threats.

She mentioned ISP numbers and IP addresses and said that is ordinary; it is like looking in a phone book. I would like to quote Ann Cavoukian, Information and Privacy Commissioner of Ontario, who I am sure my hon. colleague would agree is a vigilant defender of Canadians' rights. She said that getting government information on an IP address is not like the digital equivalent of using a phone book. She stated:

...customer name and address information ties us to our entire digital life, unlike a stationary street address. Therefore, “subscriber information” is far from the modern day equivalent of a publicly available “phone book”. Rather, it is the key to a much wider, sensitive subset of information.

I would like to ask my hon. colleague why this large subset of sensitive information would be opened up under Bill C-13 to so-called public officers, which would include reeves, wardens, fisheries officers, and mayors. Under Bill S-4, this information will also be turned over to corporations that ask for it through telecoms. Then the telecoms would be given blanket immunity not to tell Canadians. Why is it that the government is going to expand who has access to this sensitive subset of information on the private lives of Canadians?

Privacy

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, nothing could be further from the truth.

Personal information that is protected by the charter requires a warrant. This is what Rogers had to say when asked about this, “Where there is an immediate danger to life; we will provide information to law enforcement agencies to assist with 911 service, missing persons cases, individuals in distress”.

That is what we are talking about. I wish the opposition would support us. There is a bill before the House, Bill S-4 that will help tighten this even further and make the bill even better.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, Canadians were spied on 1.2 million times last year, and under the government, it is about to get a lot worse. Under Bill S-4, the Conservatives will now make it legal for corporations to call telecoms and demand an individual's personal information.

Under Bill C-13, peace officers or public officers, who are defined in law as small town reeves, fisheries inspectors and officers and yes, mayors like Rob Ford will now be able to call telecoms and demand our personal information.

It is like a massive fishing expedition. Why has the government declared open season on the private rights of law-abiding Canadian citizens?

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, Bill S-4 is an update. This is what the Privacy Commissioner had to say about it, “I welcome proposals...” in this bill. This bill contains “...very positive developments for the privacy rights of Canadians”. She went on to say, “I am pleased that the government...has addressed issues such as breach notification...”.

It is a good bill and I do hope the opposition will consider supporting it.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, in reply to our questions on the sharing of personal information between telecommunications companies and government agencies, the Minister of Canadian Heritage said last week that Bill S-4 would solve all the problems. The exact opposite is true. Even worse, we learned today from the press that the government has just launched an internal investigation to determine the extent of the problem.

In other words, the Conservatives have no idea of what is happening in their own agencies. Will they at least release the results of this investigation?

Opposition Motion—Safeguarding of Personal Information

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

Mr. Speaker, I do take the member up on the first point that she made. All Canadians should be concerned about privacy. All Canadians may be concerned about it, but the Conservative government is definitely not concerned.

I mentioned two bills, Bill C-13, the bill aimed at attacking cyberbullying, and Bill S-4, the digital privacy act. Both of these bills expand warrantless disclosure of Internet or cellular subscriber information to law enforcement.

There is no oversight. The Conservative government does not have a grip on the laws of social media.

[Ryan Cleary, NDP, St. John's South—Mount Pearl, NL]

Mr. Speaker, I stand in support of the motion by the hon. member for Terrebonne—Blainville.

The motion calls on government to make public the number, and just the number, of warrantless disclosures made by telecom companies at the request of federal departments and agencies. The motion also calls on government to close the loophole that has allowed the indiscriminate disclosure of personal information of law-abiding Canadians without a warrant.

To simplify, how many times have telecom companies handed out personal information about Canadians without a warrant to government? The government must find an immediate way to shut down the loophole that allows such personal information to be released.

We live in an incredibly connected world. Earlier this year I travelled to Tanzania, Africa, to tour Canadian development projects with a group called Results Canada. Its mission is all about ending extreme poverty, and I did see some extreme poverty. One of the images that will always stick with me is walking into a maternity ward at a rural hospital, or what they called a hospital. The maternity ward was crammed with nine or 10 beds, but there were two women in labour to a single bed.

The Tanzanians I met were the finest and best kind of people, a lovely people, but they were living with basically nothing. Still, almost every adult I came across, who could have absolutely nothing but the second-hand clothes on their back and be sleeping under a tree, still had a cellphone, and they looked at the screens as often as we do.

My point is that from Tanzania to Mount Pearl, Newfoundland and Labrador, my neck of the woods, the dependency on the Internet and on cellphones is universal.

Just this weekend I read an article by Stephen Hawking, the Nobel Prize-winning physicist, on how artificial intelligence—and we are almost to that point—could be the worst thing to happen to humanity. It would be more or less the rise of the machines. I cannot even imagine a country being led by a robot.

Oh, wait; yes, I can.

Another article I read this weekend outlined how U.S. intelligence whistle-blower Edward Snowden has warned that entire populations, rather than just individuals, now live under constant surveillance. I do not know if it is to that point in Canada, but we do have some serious cause for concern.

Let us look at the numbers first.

In late April, we learned that government departments and agencies—the RCMP, Canada Border Services Agency, and CSIS, the Canadian spy agency—requested personal information from telecom companies almost 1.2 million times in 2011 alone. That is staggering. It is a jaw-dropping rate. As the previous speaker said, it is one request every 27 seconds.

However, the number of requests for personal information is most likely greater than 1.2 million, because three of nine telecom companies told the Privacy Commissioner how many times they granted the government's requests for customer data, not how many times the government asked for the data. It was how many times they gave the data.

It is reported that wireless telecom companies complied with the government's requests for customer data at least 785,000 times. The 2010 data from the RCMP show that 94% of requests involving customer name and address information was provided voluntarily without a warrant.

Here is another indicator or how often warrants were used or not used. Canada Border Services Agency obtained customer data from telecom companies 19,000 times in one year, but it obtained a warrant in fewer than 200 of those cases.

Do Canadians have a problem with telecom companies handing out their personal information left, right, and centre? Yes, we do. This is not 1984 or Brave New World. The idea of a Conservative Big Brother does not sit well with Canadians.

That said, it is generally understood across the board that police need information to catch criminals and to protect Canadian society. There is no time to get a warrant when a life is in danger, when a life is in jeopardy.

However, this is beyond that. At least 1.2 million requests for personal information, most times without a hint of a warrant, is a staggering statistic. The current Conservative government is paying to access our personal information, to the tune of between $1 and $3 for each request.

More than two years ago in this House, the former minister of public safety, Vic Toews, introduced Bill C-30, a bill to expand police surveillance of the web. At the time, he said “[You're either] with us or with the child pornographers”. That statement got the attention of all of Canada, and the immediate and appropriate backlash forced the Conservatives to back down, to walk away from the bill.

Since that outrageous bill was dropped and Toews was appointed to the Manitoba bench—but that is another story—the current government has introduced other legislation to this House that it says will protect the privacy of Canadians. In fact, the legislation may actually increase spying on Canadians without a warrant. The first example, Bill C-13, is a bill that is aimed at tackling cyberbullying and is expected to expand warrantless disclosure of Internet and cellular subscriber information to law enforcement agencies. Another example is Bill S-4, the digital privacy act, which would extend the authority to disclose subscriber information without a warrant to private organizations, not just law enforcement agencies.

The government has a bad habit of doing through the back door what it cannot do through the front door. The current government also has some hypocritical tendencies. On the one hand, the Minister of Industry argued that the long form census was intrusive, so the Conservatives eliminated it. On the other hand, this administration has no qualms and sees nothing wrong with invading the private information of Canadians and not telling them about what it is doing. It has repeatedly introduced legislation that would make it easier for Conservatives to snoop on Canadians.

Here is another example of hypocrisy. This country's information watchdog has said that it has been flooded with complaints that the current Conservative government is too often citing security in order to withhold documents requested under the Access to Information Act. The Conservatives are using the security excuse to withhold public information at the same time that the floodgates are open on the personal information and security of Canadians.

We live in an age where technology is advancing at an incredible pace and rate. Yet, the Privacy Act that is meant to protect the privacy of Canadians and keep government accountable has not been updated since 1983. That was before the Internet, Google, email, Facebook, and Twitter. Another act, the Personal Information Protection and Electronic Documents Act, has not been updated since 2000, also before social media was born.

New Democrats believe that privacy laws should be modernized. We also believe they should be strengthened, not weakened, to better protect the personal information of Canadians. We also believe we can pursue bad guys and throw the book at them without treating law-abiding Canadians like criminals and violating their rights.

I will end with words from Edward Snowden, the former U.S. intelligence contractor, who said last week that state surveillance today is a euphemism for mass surveillance. He said:

It's no longer based on the traditional practice of targeted taps based on some individual suspicion of wrongdoing. It covers phone calls, emails, texts, search history, what you buy, who your friends are, where you go, who you love.

In so many ways, the Internet and social media are the new frontier. They are still the new frontier. It is our duty to ensure that laws and security do not fall to Big Conservative Brother.

[Mathieu Ravignat, NDP, Pontiac, QC]

Mr. Speaker, I have the honour of rising in the House on behalf of the people of Pontiac to support the opposition motion moved by my hon. colleague, who does an excellent job when it comes to protecting the privacy of Canadians in the digital age.

I will be sharing my time with the wonderful member for St. John's South—Mount Pearl, who tells me that his riding is the most beautiful in the country. However, I have to disagree with him because surely Pontiac is the most beautiful.

The subject of this motion could not be more important: the privacy of Canadians. The good people of the Pontiac are as concerned as other citizens that the increasingly technological world we live in should respect the privacy of individuals. This privacy may be breached in all sorts of ways today, but governments, as well as companies, have a fundamental responsibility to ensure that they protect the private lives of Canadians.

To me, the privacy of Canadians is sacrosanct. We are a G7 country where democracy has been stable, and we have a duty to our fellow citizens in this regard. However, we must remain constantly vigilant when the government begins to creep into the lives of Canadians. This is a slippery slope in any democracy, and certain inherent dangers exist in the sharing of private information with the government. This begs the question: what limits are imposed on governments today when they request information that is not voluntarily given by Canadians?

We have learned recently that Canadian law enforcement agencies have begun to request massive amounts of information on Canadians from telecommunications companies. Due to advances in technology, it is the telecommunications sector, and providers in particular, who collect massive amounts of data about their subscribers.

What is worrying is that this is not the first time we have heard this. In 2011, according to the Privacy Commissioner, telecommunications providers responded to 1,193,630 requests for the personal information of Canadians. That is an average of one request every 27 seconds. This does not even cover it, since only three of the nine major telecom companies actually informed the commissioner's office of how many times they granted the government's request for consumer data.

Of this staggering number of requests, figures provided to the office in late 2011 show that wireless telecom companies complied with the government's request for customer data, and the vast majority of these requests were done without a warrant or even information sent to the individuals concerned. No consent was sought, and no consent was given.

The situation is so bad, and so many requests have been made, that one major company actually had to install a mirror of their data on a network so that it could send this raw data traffic directly to the federal authorities requesting it.

A concerted government response is clearly required and urgently needed to protect the privacy of Canadians. Instead, seemingly to have an increased amount of information on Canadians, the government has actually eroded the protection of the privacy of Canadians since it formed government. Whether this has been on purpose or by accident, we can judge the consequences.

For example, it has consistently refused to update any of the laws that keep the government accountable with regard to the privacy information of Canadians. The privacy laws have not been updated since the 1980s. That was before Facebook. In fact, the Internet was in its infancy back then. We have to do better.

By allowing thousands of breaches of personal information, the government has also consistently shown itself to be incapable of adequately protecting Canadians' privacy within its own departments, as we have seen with the recent Heartbleed situation or as one can recall from the letter debacle at the CRA. Contradictions abound, because under the pretext of protecting the privacy of Canadians and while decrying heavy-handed government, the industry minister argued that the long form census was intrusive and eliminated it, yet the government sees nothing wrong with invading Canadians' private information without a warrant and without even telling them.

It has repeatedly introduced legislation that makes it easier for Conservatives and the government to snoop on Canadians. For example, we can remember the public safety minister's introduction of the infamous Bill C-30, known as the online snooping bill. Fortunately, Canadians were paying attention. They were outraged, and the government was forced to back down. Since then, though, Bill C-13, the government's cyberbullying law, though well-intentioned, includes lawful access provisions that would expand warrantless disclosure of information to law enforcement by giving immunity from any liability to companies holding Canadians' information if they disclose it without a warrant. This makes it more likely that companies would have to hand over information without a warrant, as there are no risks they would face or any criminal or civil penalties if they do so.

We can also mention Bill S-4, the new so-called digital privacy act, which would go even further and allow private sector organizations to hand over Canadians' private information. This again could be done without consent and without a court order to any organization investigating a breach of contract or potential violation of any law. This could also be done in secret, without the knowledge of the affected person.

We may, quite reasonably, ask why the government is not taking the privacy of Canadians more seriously. Where is the libertarian zeal that motivated so many of my colleagues on the other side of the House, the idea that government was too big and too intrusive in the lives of Canadians? The reality is that government has crept more into the lives of Canadians under the watch of this government than at perhaps any other time in Canadian history.

Many questions remain unanswered. The citizens of my riding would like to understand why breaches to their privacy are happening more and more frequently. The onus is on the government to prove there is enough crime or potential terrorism or other matters of national security to justify 1.2 million requests for personal information in a single year.

However, what concerns me the most is the lack of due process. It seems to me that when law enforcement agencies decide they want private information on citizens, at the very least there should be a good cause for them to seek it. In our current situation, that determination is assured by the warrant process. If a request does not meet the requirements of a warrant, then it should simply not be made.

Since I am short on time, I will skip ahead. Essentially, Canadians have a right to know who is snooping on them and how they are doing it. I just do not understand why the Conservative government does not simply come clean with Canadians and give them the whole picture of what is really going on. On our side of the House, we want this information to be provided to Canadians as rapidly as possible.

Canadians understand that law enforcement agencies need information to track down criminals.

However, the fact that the government is requesting Canadians' personal information from telecommunications companies without a warrant 1.2 million times a year is completely unacceptable. The problem with warrantless disclosure is that it is uncontrolled and results in information being disclosed much more frequently than is justified.

In conclusion, it is clear that our privacy laws need to be updated in order to better protect Canadians' personal information. These laws must not be weakened. We need to be able to take effective legal action against criminals without infringing on the rights of law-abiding Canadians and treating them like criminals.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, although I appreciate the fact that they are participating in the debate, I have to say that the Conservatives seem a little confused. This is not a debate on Bill S-4; this is a debate about an NDP motion to make the system for the disclosure of telecommunications information to government agencies more transparent.

I would like to ask my Conservative colleague the following question. It costs between one and three dollars every time a government agency or department makes a request for personal information from a telecommunications company. If we add that up, it costs at least $1.2 million and as much as $3 million every year. How can the member justify these costs to the citizens who elected him?

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Mr. Speaker, I am pleased to rise in the House today to highlight the measures that our government has taken to protect the privacy of individual Canadians.

First and foremost, I would like to discuss Bill S-4, the digital privacy act. The bill would make important amendments to the Personal Information Protection and Electronic Documents Act, otherwise known as PIPEDA, with the express purpose of providing new protection for Canadians when they surf the web and shop online. PIPEDA was passed in the House of Commons in 1999 and implemented in 2001. There is nothing new about it, and there has been no mention from the opposition on amendments since that time. With Bill S-4, the government would implement new measures to better protect the personal information of Canadians.

Let me speak a little about PIPEDA in general. PIPEDA is our primary piece of legislation that lays out the ground rules for how private sector businesses collect, use, and share personal information. What kind of personal information are we speaking about? It includes name, age, banking records, shopping history, et cetera.

We know that this kind of information is gathered by many companies and organizations in the course of their day-to-day transactions. The fear, of course, is that in the wrong hands this kind of information can be exploited. In the worst cases, it is used to commit fraud, identity theft, or other harmful acts. To combat these kinds of malicious deeds, the digital privacy act would implement tougher rules to protect the privacy of Canadians.

Protecting Canadians is a major pillar of digital Canada 150, which the Minister of Industry launched last month, to help our country take full advantage of the economic opportunities of the digital age. Under the pillar of protecting Canadians, the digital privacy act would protect consumers online, simplify rules for businesses, and increase overall compliance with our privacy laws.

Before we tabled Bill S-4, the government consulted the Privacy Commissioner and got her views on how to best move forward with modernizing Canada's intellectual property laws. The minister spoke to her again before tabling the legislation. In fact, here is what she said about our digital privacy act and our efforts to best protect Canadians online. She said she welcomed the proposals in the bill. She said this bill contains “very positive developments for the privacy rights of Canadians”.

In addition, the NDP digital critic, the member for Terrebonne—Blainville, said this about our government's digital privacy act: “Overall, these are good steps. We have been pushing for these measures and I'm happy to see them introduced”.

The first element I would like to touch on is a familiar one to Canadians in this digital age, data breaches. New rules in the digital privacy act would require organizations to tell Canadians if their personal information has been lost or stolen. As part of this notification, organizations would also have to tell individuals what steps they can take to protect themselves from potential harm, actions that could be as simple as changing their credit card PIN or email password. At the same time, the bill would require organizations to report these data breaches to the Privacy Commissioner of Canada. With the passage of the bill, organizations that deliberately break the rules would face significant penalties, of up to $100,000 for every individual they fail to notify.

In keeping with the motion before us and its reference to the Privacy Commissioner, I would like to address the changes in the digital privacy act that would ensure that the Privacy Commissioner has the right tools to help protect Canadians' privacy. Bill S-4 would give the Privacy Commissioner the ability to negotiate voluntary compliance agreements with organizations. Under these agreements, organizations would make binding commitments to ensure the privacy of Canadians. This would allow organizations to be proactive and work collaboratively with the Privacy Commissioner to quickly correct any privacy violations that may have been discovered. In exchange, those organizations can avoid costly legal action. At the same time, the agreements would be binding and would give the Privacy Commissioner more power to hold organizations accountable in court and make sure that they follow through on promises to fix privacy problems.

The digital privacy act will also provide the commissioner with more power to name and shame companies that do not play by the rules. This will ensure that Canadians are informed and aware of issues that affect their privacy.

Finally, the digital privacy act will extend the timeframe, to one year, for Canadians as well as the Privacy Commissioner to take a company to court. Under the current rules, the Privacy Commissioner has only 45 days. In many cases, this is not enough time for an organization to either voluntarily fix the problem or for the Privacy Commissioner to prepare a proper application.

At all times an individual's right to privacy, as guaranteed by the Canadian Charter of Rights and Freedoms, must be respected. Despite any exception provided for in PIPEDA, law enforcement agencies must respect the charter and have a warrant or other justification to obtain private information.

Equally important in any of these circumstances, nothing in PIPEDA forces a company to turn over private information to police, government agencies, other private companies, or anyone. PIPEDA protects privacy; it does not force companies to violate it.

Bill S-4 makes sure that organizations can share information with appropriate authorities in situations that would involve providing information that will allow police to contact and communicate with the family of an injured or deceased person, sharing information in order to detect and prevent fraud, or allowing organizations to report suspected cases of financial abuse to appropriate authorities. All of these exceptions are clearly defined, and limited to circumstances where sharing this information is in the best interests of the persons involved.

Here is an example. Let us say that a bank teller notices a regular customer, a senior citizen, has been coming in lately with another person who is unfamiliar to the teller. They are making more frequent withdrawals, for more money than usual. The teller witnesses the senior handing over the withdrawn cash to the unfamiliar person. Most tellers or financial institutions would like to have the power to inform appropriate parties of this situation, such as the police, public trustees, or the client's next of kin. At the moment, our privacy law prevents the bank from informing those people who could help. The digital privacy act will remove this barrier and make sure that suspected cases of financial abuse can be reported, and the interest of seniors protected.

The digital privacy act also creates new rules whenever an organization asks an individual for their approval to collect, use, or share their personal information. This new measure will establish stronger protection for the privacy of more vulnerable Canadians, such as children. As children and adolescents spend an increasingly large amount of time online, it is important that they clearly understand the choices in front of them before they hand over private information about themselves.

The digital privacy act strengthens informed consent. Informed consent means that individuals are not just told of what is being done with their information, but that they understand the potential consequences of clicking on yes or no.

This change will require organizations to clearly and plainly communicate with their target audience when asking for their consent to collect personal information. They will have to consider whether their target audience is able to understand the consequences of sharing their personal information.

I am very proud of this aspect of Bill S-4. Given the proliferation of iPads, laptops, and BlackBerrys among our youth, the stronger rules included in this bill will make sure that individual Canadians, in particular children and adolescents, can understand the potential consequences of the choices they make.

In conclusion, the elements of the digital privacy act that I have laid out today have been carefully thought out, with the best interests of all stakeholders in mind. Our government is confident that by better protecting consumers, streamlining rules for business, and increasing compliance, the digital privacy act will make Canadians safer and more secure.

The digital privacy act will strengthen Canada's privacy laws by making sure that Canadians are informed if their privacy has been put at risk, and by holding to account those organizations that deliberately break the rules.

[Sean Casey, Liberal, Charlottetown, PE]

Mr. Speaker, Bill C-13, presently before committee, contains in it an immunity for the voluntary, secret, and warrantless disclosure of information by telephone companies. Bill S-4, presently before the Senate, expands the entities that can receive this information, so the two of them added together would result in greater lawful, warrantless, and secret disclosure of Canadians' subscriber information.

Does the minister not feel that Canadians have any right to know when and how their subscriber information is being disclosed to an increasingly broad audience?

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I am very pleased to rise today on this very important issue. The New Democratic Party calls for accountability and an explanation on behalf of Canadians into the widespread spying and interference of Canadians' Internet use and their cellphone use under the current government.

What we are asking for today is eminently reasonable. We are asking simply to ensure the powers of the Privacy Commissioner of Canada, the member who represents us as a parliamentary officer, who represents the Canadian people, and that she have the authority to ensure that the laws of this land are being followed.

Now, we have a government, of course, that will do anything it can to obstruct the work of the offices of Parliament because right now the offices of Parliament are about the only bulwark standing in the way of the numerous underminings of Canadians' legal rights, and even the illegal activities that are being undertaken by the Conservative Party.

It has been said that one of the foundations of a democracy is to ensure maximum transparency for government and maximum privacy for citizens. However, the current paranoid and secretive government has flipped it. The Conservatives have maximum privacy for their black holes of administration where they refuse to answer the simplest questions, and they are getting maximum transparency on the lives of Canadian citizens to the tune of 1.2 million requests of telecoms last year.

Now that is a conservative number, and I say “conservative” in the way the Conservatives have begun to use this, because not all the telecoms bothered to even respond to the Privacy Commissioner of Canada. That is a very disturbing trend.

What does the 1.2 million requests mean? It means that every 27 seconds someone from a government agency, who, we do not know; for what reason, we do not know; for what possible motive, we do not know; picks up a telecom and asks for information about the private lives of Canadian citizens, and gets it without warrant.

Let us debunk the excuses we have heard from the Conservatives on this.

First is the bogeyman excuse. Conservatives use the bogeyman all the time. The bogeyman is out there roaming the streets. The member for Oak Ridges—Markham the other day made it sound like his neighbourhood was a case of Shaun of the Dead. There are these violent criminals and terrorists all over the place and so the Conservatives have to be able to call up a telecom immediately to gather any information they need whenever they want it.

Those laws already exist and it is fairly straightforward to get information if a violent crime is occurring. However, we are being led to believe that the bogeyman is out there and the current government has to stop it.

How does the government define terrorists?

I think we should say that, in this whole piece on spying, we are dealing with the revenge of Vic Toews. I refer members back to February 2012 when Vic Toews branded the new anti-terrorism strategy, “building resilience against terrorism: Canada’s counter-terrorism strategy”.

The government was going to go after terrorists, which included domestic extremism that is “based on grievances--real or perceived--revolving around the promotion of various causes such as animal rights...environmentalism and anti-capitalism”.

If a person is against the Northern Gateway Pipeline, under the current government's framework, he or she is a potential terrorist. Therefore, the government can decide to follow his or her movements, as he or she is one of the bogeymen.

A concern about animal rights is not that of concern for animal rights such as our Prime Minister's wife who tells us that 1,000 murdered or missing women may be a great cause, but they are here for abandoned cats. The government is probably not spying on the Prime Minister's wife. However, someone else who might have concerns about animal rights, and it is in there, is a potential terrorist and worthy of picking up the phone.

One of the other excuses is that the Conservatives are not asking for anything that is not already the norm. It is just like picking up a phone book and looking up a number. Calling a telecom and demanding private information on Canadians is just like using a phone book.

The Privacy Commissioner of Ontario, Ann Cavoukian, says that is a load of bunk. She said the following about getting even basic subscriber information such as ISP numbers:

...customer name and address information ties us to our entire digital life, unlike a stationary street address. Therefore, “subscriber information” is far from the modern day equivalent of a publicly available “phone book”. Rather, it is the key to a much wider subset of information.

Then the Conservatives say, “Don't you trust our police?” We certainly would trust the police. However, we also see that Ann Cavoukian has said that at no time have Canadian authorities provided the public with any evidence or reasoning that Canadian law enforcement agencies have been frustrated in the performance of their duties as a result of shortcomings in the current law. The privacy commissioners in their joint letter, also write to the Prime Minister saying, “The capacity of the state to conduct surveillance and access private information while reducing the frequency and vigour of judicial scrutiny” is the heart of the issue.

We all remember when Vic Toews stood up in the House and told Canadian citizens who were concerned about the fact that they were being spied on, that they were basically in league with child pornographers if they had the nerve to stand up for them. That was such a boneheaded move and it caused such a blowback on the government that they had to retract the legislation. Why would the Conservatives show intent on pushing that through? We now know, they were trying to legalize what has become the common practice. Their shadow world of spying on Canadians is not legal. Gathering this information without warrants is not legal. This is why they put forward Bill C-30, to attempt to deal with it. We all remember Vic Toews had one of those pieces, “The Minister may provide the telecommunications service provider with any equipment or other thing that the Minister considers the service provider needs to comply with” their ability to spy on Canadians.

That seemed like such a bizarre request at the time, but we have seen with the NSA and the widespread spying on American citizens and citizens around the world is exactly what Vic Toews was getting at, which is the ability to create mirror sites. The fact that we just learned in Der Spiegel that the NSA tapped the underwater cable network between Europe and U.S.A. to listen in on what ordinary citizens were doing on the Internet. The Conservatives have the same vision. They wanted to legalize that ability, and they were frustrated.

We are hearing the biggest excuse from the Conservatives. They realize the Vic Toews approach of accusing ordinary Canadians of being like child pornographers really did not work, but now they would reassure Canadians that they would fix it. They will fix it all right. They will fix it so that not only they will get to spy on Canadians, but anybody who wants to will be able to spy on Canadians: corporations can spy on Canadians, and all manner of very dubiously named authorities now will be able to spy.

Let us go through some of the issues on Bill S-4 and Bill C-13. According to Michael Geist, Bill S-4 will “massively expand warrantless disclosure of personal information”, because under Bill S-4, “an organization may disclose the personal information without the knowledge and consent of the individual...if the disclosure is made to another organization”. Not the laws of the land, not the RCMP, not anti-terrorism units, but if an individual is in dispute with a corporation over some contractual obligation, it can call their telecom, have their information handed over and they will not be told.

The Conservatives will certainly fix it. They will fix it to make widespread snooping of everything we do all the time perfectly legitimate for any corporation that just phones up and says it wants to know what they are doing on the Internet.

That is not all. Let us look at Bill C-13, which will give a public officer or a peace officer the ability to call telecom, demand information, and the telecoms will receive legal immunity for passing over this private information.

An interesting article in the National Post points out that Rob Ford will now be able to make these requests, because, oh, yes, he is a public officer, and under the act, if Rob Ford wants to find out what his neighbours are doing, interfering with the drug gangs in Rexdale with whom he might be friends, he would actually be able to make the calls.

The Criminal Code describes these peace officers, public officers, as including reeves of small towns, county wardens, who would be able to get information, and even people designated under the Fisheries Act. However, there is another element that is really important. Under the present laws, even with all this snooping that is going on, it has to be part of an investigation. The government would remove the caveat that says this snooping, this spying on the rights of Canadians does not have to have anything to do with an investigation. If the Conservatives want a fishing trip, if they want to keep tabs on them, they will be able to do so.

This needs to be dealt with. This is a government that is spying on law-abiding citizens and treating them as criminals, and it needs to be held accountable for this abuse of Canadians' rights.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I want to thank my hon. colleague. I have great respect for the excellent work she does for Canadians on this very important file.

I would like to ask her about the spin we are hearing from the government. Conservatives keep changing their story about how they actually somehow care for Canadians' private information, and the Minister of Industry is telling us that Bill C-13 and Bill S-4 will fix the problem. They will fix it, all right.

Under Bill C-13, anyone designated as a public officer will be able to gather information without a warrant. It is in the bill. Under clause 20, what a peace officer or public officer would be in the Criminal Code would include wardens, reeves of small towns, sheriffs, justices of the peace, and persons designated under the Fisheries Act, meaning that the Fisheries Act would be able to get information from the telecoms about folks in Timmins—James Bay who are out fishing. Of course, mayors are included as well.

It seems to me that the government is now moving backward to actually legalize widespread snooping and open up snooping to all manner of people who have no business being able to find out personal information, what people do on the Internet, or who they phone.

I would like to ask my hon. colleague why she thinks the government is telling Canadians that allowing widespread snooping by wardens, reeves, sheriffs, mayors, and people designated under the Fisheries Act will somehow protect Canadians' privacy.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

moved:

That, in the opinion of the House, the government should follow the advice of the Privacy Commissioner and make public the number of warrantless disclosures made by telecommunications companies at the request of federal departments and agencies; and immediately close the loophole that has allowed the indiscriminate disclosure of the personal information of law-abiding Canadians without a warrant.

Mr. Speaker, I would like to begin by stating that I will be sharing my time with my colleague from Timmins—James Bay.

I am very pleased today to move this motion to ensure that justice is served for Canadians. However, I am very disappointed to have to rise once again to protest this government's extremely reprehensible actions.

I would have thought that, after three years, it would have finally understood. However, once again, the government has been caught spying on its own people.

With such ridiculous statements as, for example, if we did not support bill C-30 we were siding with pedophiles, the government has constantly tried to minimize the impact of its proposed measures on the lives of Canadians, all the while boasting and insinuating that it is proposing reasonable and necessary measures, which has been proven to be false by many impartial stakeholders.

The Conservative government called our assessment “speculation and unwarranted fearmongering” or a series of outlandish conspiracies made up by the NDP. After being harshly criticized by the public, media, and civil liberty and rights groups, as well as by privacy experts, the government finally listened and withdrew these bills or let them die on the order paper.

However, we still need to point out that exploiting the personal information on Canadians without reasonable cause and without a warrant is a huge violation of their privacy. I do not think I have heard about 1.2 million criminals being convicted of accessing personal information in 2011.

Last week, new revelations showed that government agencies and departments allegedly asked telecommunications companies to share personal information with them without a warrant. Not once, not a hundred times or a thousand times. They asked 1.2 million times.

We condemn this highly questionable tactic, since there is no legislative oversight to determine whether the government's reasons for accessing this information were valid.

Like many Canadians, I understand and support the need for security authorities to have the tools they need to fight crime in our country and to make us feel safe at home.

However, how can the government justify 1.2 million requests in a single year to achieve that goal? That happened in 2011, and the government was not required to explain what this information was necessary or how and for what it would be used.

When I think of the majority of Canadians who abide by the law and who could be affected by these requests, I find it unacceptable, disgusting and incomprehensible that the government is treating them like criminals.

The privacy of Canadians has been taken lightly by past Liberal and Conservative governments for far too long, and Canadians affected by the thousands of data breaches in government agencies are paying the price. To hear that the government is snooping on them as though they were common criminals when they have done nothing wrong is another blow on top of it all. Last week the government tried to make us believe these requests were made for public safety reasons, but let us look at the case of the CBSA.

In response to my order paper question, after reviewing the number of requests made from the CBSA in one year, we find that no requests were made in exigent circumstances. The 18,849 others were made in non-exigent circumstances. From these requests, only two were made for national security reasons, none for terrorism alerts, none for foreign intelligence, and none on the grounds of child exploitation, so it is hard to believe the government when it says that these millions of requests were made for national security reasons when the numbers speak a very different truth.

Canadians understand that law enforcement institutions need information to identify, catch and judge criminals. However, when the government makes 1.2 million requests for Canadians' private information from telecommunications companies per year, that is not just about cracking down own crime; that is spying.

The vast majority of Canadians are law-abiding. There is no reason for the government to engage in such broad spying activities. If the Canadian government decides to spy on its own citizens, it should do so only if it has reason to suspect them and only with a warrant.

If the law permits this kind of warrantless spying, the law must be changed immediately, and that is what the NDP is trying to do today. If the government needs a warrant to listen to Canadians' phone conversations, the same should apply to their online activities.

We understand that certain extremely urgent circumstances do not permit the obtaining of a warrant. However, the information we received from the Privacy Commissioner last week goes far beyond the imaginable: 1.2 million requests for subscriber data without a warrant is unacceptable and unjustifiable.

In Canada, we are very lucky to have a legal framework for obtaining a warrant. That framework protects Canadians and prevents abuses by the authorities. Unfortunately, there is a loophole in the system the Liberals introduced.

Today, the Conservatives are taking advantage of that loophole to spy on their own citizens. Clearly, the government is no longer in control of the warrantless disclosure procedures.

As I said earlier, the Conservatives' spying cannot be justified on national security grounds. Moreover, it is done in secret. The Privacy Commissioner is not even informed.

If the government had a real, viable motive for snooping on Canadians, it would have no problem whatsoever with warning Canadians when they were being snooped on, it would have no issue working with the OPC, and it would strengthen our laws to better protect Canadians against these types of abuses.

We do not know why, how often or how long the government has been spying. What is even more incredible is that the Conservatives have long been trying to expand the legal framework around requesting information without a warrant. If the government decides to spy on Canadians, there should be just cause, it should be overseen by the courts and it should happen only under exceptional circumstances.

What is even more ridiculous than the government's unwillingness to protect Canadians' privacy is its complete lack of understanding about the scope of the problem. Just last week, the Privy Council Office asked that all departments provide details about the number of personal information requests submitted to various telecommunications companies over the past three years.

That proves that the government has abused the loophole in the law to the point where it has lost control of its departments on this issue.

The Conservatives have proven that they are unable to protect the privacy of Canadians. The Privacy Act dates back to 1983, before the arrival of the Internet, and PIPEDA has not been updated since 2000, before the age of social media.

Instead of strengthening the laws and increasing government accountability, the Conservatives are moving in the other direction. Instead of protecting Canadians' privacy, Bills C-13 and S-4 will increase the likelihood that the government will spy on its own citizens. From an ethical standpoint, that is extremely problematic.

With Bill C-13 alone, the government would expand the number of people who can make requests for subscriber data so that even people like Rob Ford could access our personal information. It would create legal immunity for voluntary disclosure of personal information and it would expand the circumstances under which personal information could be disclosed.

As if that were not enough, the government is using taxpayers' money to spy on them. Government agencies pay telecommunications companies between $1 and $3 for each information request. That means that, at the very least, Canadian taxpayers have paid between $1.2 million and $3.6 million to be spied on. I say that is the minimum because only some of the telecommunications companies have disclosed how often they provide information to the government.

If all of those information requests were justified, and if the telecommunications companies were not worried about disclosing their practices, I would likely not be making this speech today. Unfortunately, the Conservatives are trying so hard to hide their spying that it is worrisome.

What are they using all that personal information for? Can they even justify the importance of the information? It is clear that the government believes that Canadians are criminals because it spies on them without their knowledge, as though it suspected them of something. This motion defends the privacy rights of law-abiding Canadians, and it is meant to counter the government's nefarious attempts to get information by the back door.

Since becoming the critic for digital issues, I have risen dozens of times to draw attention to and criticize the alarming state of our privacy laws. Laws that are meant to properly protect us in the digital age should have been revised years ago and are now unsuitable for protecting the public and our children.

In my time as opposition critic for digital issues, I have seen not one but four different pieces of legislation introduced in the House that would facilitate government snooping instead of fixing the problem.

Canadians are worried. They are right to be. The Internet that they have known as an open and free space for social and political discussions is threatened by the snooping of their very own government. Law-abiding citizens should be able to benefit from the Internet without the threat of being treated like common criminals.

I ask all my colleagues to vote in favour of our motion in order to restore Canadians' trust in matters concerning the protection of their privacy and of the Internet as the social and political tool it should be.

Privacy

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, the hon. member knows quite clearly that Canadians' personal information that is protected by the charter requires a warrant. Moreover, the legislation that governs this, of course, was introduced by the Liberal Party, and we had not heard a word from the Liberals until a couple of days ago that there were any problems with it.

Having said that, we did recognize that some updates needed to happen. That is why we brought a bill forward, Bill S-4, which will address this even further. We have been consulting, and we have spoken to the Privacy Commissioner. I would suggest that the opposition support that bill.

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, it seems that the opposition is finally moving in the right direction. I know that yesterday, the Liberals said it was millions and millions of Canadians who were being spied on. Then it was 1.2 million to two million from the NDP. Now it is thousands. I am sure by next week, the truth will actually be talked about by the opposition. What we are doing here is that the telecoms are being asked, in instances of national security, in instances when violent crime is taking place, to assist our authorities. There is, of course, civilian oversight to make sure that this is all done properly.

Moreover, any personal information protected by the Charter requires a warrant. There is Bill S-4 in front of the Senate, which will help improve this even further.

[Mathieu Ravignat, NDP, Pontiac, QC]

Mr. Speaker, he is referring to the famous Bill S-4, as though it will fix everything. I do not know if they have read their own bill, but I must say that it will not change a thing. As long as the government continues to use national security as an excuse to invade the privacy of hundreds of thousands of Canadians, this problem will continue.

When will the government propose measures to ensure that telecom companies disclose the information collected on Canadians? When?

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, the hon. member knows that that is not true. Moreover, as I was mentioning toward the end of my last answer, there is a bill being brought forward to look at tightening this up a little further. It is Bill S-4. The minister has been in contact with the Privacy Commissioner. She has suggested that the bill does advance Canadians' privacy further.

I would suggest that the opposition really take a hard look at what it is they are suggesting. Our security services do excellent work in making sure that our communities stay safe. It is time for the opposition members to get on board with them and trust that they are doing a good job. I know that we trust them to do that, and the results have been staggering. Great work.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, the NDP is coming very close to setting the indoor record for missing the point here.

The Personal Information Protection and Electronic Documents Act, section 7, spells out very clearly the parameters of this law. Beyond that, Bill S-4, our new legislation, the digital privacy act, further protects Canadians' privacy.

That is what the Privacy Commissioner said when she said that this bill contains “...some very positive developments for the privacy rights of Canadians”.

The NDP critic on this issue said, “We have been pushing for these measures and I'm happy to see them introduced”. That is the NDP position on our bill.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, that is not the case at all. We are talking about a piece of legislation from 2001. It was passed in the House of Commons in 1999 and implemented in 2001. There is nothing new about it.

With Bill S-4, we are implementing new measures to better protect the interests of individuals.

If this particular colleague of ours does not like this legislation, then I just have to wonder why she said, when we introduced the bill, “We have been pushing for these measures and I'm happy to see them introduced”.

That is what she herself said when we put the bill forward.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, it is an interesting approach to a parliamentary debate tactic to say that Canadians cannot trust the legislation that he in fact proposed for Canadians and that Canadians should not trust him because his legislation was so flawed.

We, of course, protect the privacy of Canadians. We are empowering the Privacy Commissioner with new tools to further protect Canadians online. Bill S-4, the digital privacy act, goes further than the Liberal Party ever endeavoured to go and further than the NDP has ever proposed to go in further protecting the privacy of Canadians online.

When the parliamentary committee considers this legislation, of course it can compel witnesses, and we are happy to hear what—

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, if the member opposite does not believe in the Personal Information Protection and Electronic Documents Act, if he thinks it is inadequate, he was the solicitor general when the legislation was passed.

We have gone further forward to protect the privacy of Canadians. We are moving forward. Bill S-4 puts in place new protections for Canadians.

The Privacy Commissioner herself said about our legislation that she welcomes the proposals in this bill. She said this bill contains “very positive developments for the privacy rights of—”

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, the committee can do what it wants and ask whomever it wants to appear as a witness before the committee.

However, our government introduced Bill S-4 to protect Canadians' private personal electronic information. That is why we introduced the bill, and here is what the Privacy Commissioner had to say about it:

I welcome [the] proposals [in this bill, which contains] some very positive developments for the privacy rights of Canadians....

That is what we are doing.

[Donald Piragoff]

I believe Mr. Geist's comments are in relation to Bill S-4, and I cannot comment on Bill S-4. It's not my area of expertise nor the Department of Justice's expertise. That is a bill of the Minister of Industry.

[Donald Piragoff, Senior Assistant Deputy Minister, Senior Assistant Deputy Minister's Office, Department of Justice]

I can talk about Bill C-13. Bill S-4 is another bill, and it's not our bill. That's the bill for the Minister of Industry, I believe, so that's his responsibility. You'd have to ask other officials or other staff, Mr. Chairman, with respect to that bill.

In terms of the interplay, as the minister said, the Criminal Code provision enacted in 2004 was enacted for the purpose of clarifying that when Parliament enacted production orders in 2004, the enactment did not have a negative effect on the common law power of citizens to voluntarily provide information to the police, whether it be telcos or whether it be a person at the door. When the police come knocking at the door saying that there was a big ruckus across the street last night and asking if they saw anything, the person at the door has the choice of saying that they don't want to talk to them or saying, “Yes, I saw a lot and here's what I'm telling you.” That person would be protected. That's the common law power. It's in section 25 of the Criminal Code.

There was a concern about having a power to compel people to provide information: would this have a negative effect on the voluntary ability of people to provide information? So section 487.014 was created at the time, for greater certainty. As it says, “for greater certainty”, the fact that there is a production order does not affect the ability of people to voluntarily provide information, and that provision also said that people who provide voluntary information get the benefit of section 25 of the Criminal Code. Section 25 of the Criminal Code is the provision that says if you do something that you are authorized by law to do, you are protected from civil or criminal liability.

What the new amendment does is update the existing section 487 provision to do two things. One, because there are other types of tools that have been created by the bill, such as preservation orders, if a company voluntarily preserves data, this makes it clear that not only in providing the data but also in preserving the data voluntarily, one would be protected from civil or criminal liability.

The current situation right now with many of the telcos, for example—you wanted to know the relationship, Mr. Casey—is that there is no ability to compel a telco or an ISP to preserve information. The authorities have voluntary cooperation from some telcos and some ISPs, but not all. Nevertheless, we do have some who do voluntarily cooperate with the police and will voluntarily preserve data while waiting for the police to come back with a search warrant or a production order.

This would, then, extend the immunity provisions to also include those individuals who voluntarily preserve data, to ensure they are not liable civilly or criminally because they voluntarily cooperated with the police. That's the relationship between the two, Mr. Casey.

In terms of what the authority is, as to when telcos or other companies are authorized or compelled to provide information, one would have to look at PIPEDA, and again, that's not in my purview of expertise.

[Sean Casey, Liberal, Charlottetown, PE]

Thank you, Mr. Chair.

The minister seemed quite reticent to talk about the interplay between Bill C-13 and Bill S-4. Am I okay to ask about that? Are the witnesses comfortable talk about that?

[Peter MacKay, Conservative, Central Nova, NS]

I'm not here to discuss Bill S-4. Even if I were, we don't have that legislation in front of us here. So I'm not going to get into the provisions of a bill that we're not here to discuss.

[Sean Casey, Liberal, Charlottetown, PE]

—but perhaps I haven't framed....

Here's what I'm putting to you, Mr. Minister. Right now, the only people who can avail themselves of the warrantless powers of voluntary disclosure are those in law enforcement agencies. Bill S-4 would allow anyone who's investigating any breach of contract from any organization, whether private, public, government or not, to avail themselves of that power.

[Sean Casey, Liberal, Charlottetown, PE]

Let me finish my question, if you would, please.

One of the things that Bill S-4 would do is to expand the parties to whom telcos can, on a secret and warrantless basis, provide information. Right now, the only people that telcos can provide this information to are law enforcement authorities. This will broaden it, is that right?

[Sean Casey, Liberal, Charlottetown, PE]

While we're on the subject of PIPEDA, you're undoubtedly aware, Mr. Minister, that presently before the Senate is BIll S-4, which proposes some changes to PIPEDA and will actually relate to the section that we are presently discussing.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

I want to stay on the same topic.

The two of you talked about the fact that our legislation lacked teeth and therefore didn't do much in the way of consequences. And the commissioner has little authority to issue orders or impose monetary penalties.

Is Bill S-4 a good way to solve that problem? Is it missing certain elements? If so, what should it include to ensure we are well protected?

[Dr. Éloïse Gratton, Partner and Co-Chair, Privacy, McMillan LLP, As an Individual]

I will start. Thank you for the invitation.

I'll give the first part of my presentation in French and the second, in English.

I'd like to start by discussing the legal framework governing privacy protection and the response of business. Despite the legislation that exists, the Personal Information Protection and Electronic Documents Act, or PIPEDA, companies and organizations have no real incentive to comply with the act and implement appropriate security measures. What's the worst that could happen from a company's perspective? What are the risks if they don't comply with the act? Not much. The worst case scenario is that their reputation might be tarnished. For example, if a complaint is made, and at the end of the investigation, the commissioner decides to release the company's name, then obviously, the company's reputation might be sullied. That very seldom happens, though.

There is another potential risk. When an individual is notified by the commissioner that the act was in fact breached, that person can take the company to Federal Court for damages. The court has made a few such rulings in the past decade. In five to ten cases, the Federal Court awarded small amounts. In some cases, it awarded no damages, and in others, $5,000.

Last fall, in its ruling on Chitrakar v. Bell TV, the Federal Court awarded $20,000 in damages, and that was a first. Is this the beginning of a new trend? Perhaps. Only time will tell. One thing is for sure: not everyone has the means to take legal action against a company to obtain small amounts in damages. In privacy violation cases, the amounts often range between $5,000 and $10,000. Engaging in a court battle is a complicated and painstaking process.

Furthermore, at the federal level, no incentives exist with respect to class action lawsuits over privacy violations, which have the potential to improve compliance. Incentives do exist in other jurisdictions. And in many cases, companies comply with privacy legislation as a result. Just think of the recent security breaches. Last January, a security breach occurred at Human Resources and Skills Development Canada. In April, a security breach occurred at the Investment Industry Regulatory Organization of Canada, or IIROC. And class action suits were launched in relation to both of those breaches.

In the case of IIROC, a portable drive containing the financial information of 52,000 brokerage firm clients was lost. The damages sought were $1,000 per individual. That has the potential to motivate companies to comply, but under PIPEDA, that isn't an option. The legislation contains no such provision to motivate companies. And even if it did, a class action lawsuit isn't necessarily appealing because authorization to proceed isn't always granted.

In the Quebec case of Larose c. Banque Nationale du Canada, the Superior Court made a ruling in 2010. A typical breach, it involved a lost laptop containing the financial information of many clients. One of the clients was not very happy and took the National Bank to court. At the authorization stage, counsel for the complainant had to show that, as a result of the security breach on the bank's part, actual identity theft had occurred. The court stipulated that the fear of identity theft alone did not entitle someone to compensation. Had there been no evidence of actual identity theft, the court would not have granted authorization for a class action.

That tells you just how high the bar has been set. Proceedings of this nature are not straightforward. And the damages aren't very high. So what's left? If you can't seek compensation because you're afraid you were the victim of identity theft as a result of a security breach, there is little else you can do.

Let's come back to the legislation concerning security measures. Companies are advised to adopt security measures based on the level of sensitivity of the information. Even when companies contract out services to a third party, the legislation says they are still responsible for the information and must ensure its protection through the contract. In reality, what we often see is companies using cloud services or third-party contracts. They contract the service out and then turn a blind eye to what goes on.

I would like you to consider a provision in a piece of Quebec legislation that I see as very useful. It imposes an additional obligation on companies preparing to give or transfer personal information to a third party via a contract. I am referring to section 26 of An Act to Establish a Legal Framework for Information Technology. It reads as follows:

Anyone who places a technology-based document in the custody of a service provider is required to inform the service provider beforehand as to the privacy protection required by the document according to the confidentiality of the information it contains, and as to the persons who are authorized to access the document.

The person who entrusts the function to a service provider and transfers the data to the provider, whether via cloud computing or some other means, has an obligation to tell the service provider how to protect the information in question. I think incorporating a similar provision in our legislation could be useful.

I am active in the protection of privacy and personal information. There is a prevention component to my work. That entails advisory services, compliance, training, policy development and so forth. I am also involved in crisis management. I help with the management of security breaches, provide assistance when complaints are made to privacy commissioners in various jurisdictions and give advice related to privacy class action lawsuits. Clients rarely ask me to do any prevention work for them unless they have had some sort of crisis first. That shows that companies aren't very tuned in to the issue. And yet, the legislation exists. Are they motivated to comply with the act? Not especially, because they wait until a security breach has occurred before taking action. Not until a crisis arises do they realize how costly it can be and that they might do well to invest in prevention.

It's also interesting to see just how many resources are being deployed to compliance and prevention around the coming into force of Canada's new anti-spam legislation. That piece of legislation is being taken seriously. It includes liability provisions that apply to administrators, executives and employers. And since the penalties it sets out are quite stiff, companies take it seriously. Ever since its coming into force was announced, the legislation has monopolized my practice almost full time. Is spam a bigger problem or greater evil than security breaches or identity theft? I doubt it. Why, then, is the situation the way it is? What are we waiting for to motivate companies to invest in prevention?

I have one last point. My second part will be very short.

Some studies show that most security breaches are the result of human error. I am referring to two studies, in particular, that were conducted two years after the requirement to report a security breach was imposed on companies. The first was done by Alberta in 2012-13 and lists all the notifications and security breaches. According to that report, human error was at fault in many of the cases. The second study was done by the Ponemon Institute in 2013 and says that in 33% of cases, employee error was to blame.

That, too, shows that companies aren't taking employee training around privacy protection seriously. Very often, the security breach resulted from a laptop being left in a car. Was the employee aware that behaviour posed a risk? Was a relevant policy in place? Was appropriate training available? The jury is out.

I know time is running. The second part is going to be quick.

I want to raise the fact that currently under PIPEDA we don't have mandatory breach notification, and I believe that this may well play an important role in addressing some of the financial harm that may be triggered in the case of identity theft following a security breach.

If individuals, whether they be consumers, employees, are notified, it will help them to better protect themselves against harm, such as identity theft, because once they're notified they're going to pay special attention to their financial statements every month, every day, tracking down any suspicious or unauthorized transactions. They're going to monitor their credit through credit-rating agencies, such as Equifax and TransUnion. It will also provide businesses with an incentive to establish better data security practices in the first place.

What's the status on mandatory breach notification outside of Canada? We have it in Europe and in the United States. Most of the states in the U.S. have breach notification laws. In Canada, Alberta so far is the only private sector jurisdiction that has this law, and they prescribe fines up to $100,000 for businesses. They have realized that this breach notification obligation in their law has increased the reporting of security breaches, and it has also increased the privacy training. Businesses are more inclined and are more motivated to spend, because they realize that it's going to be an obligation to disclose the breach if there is such a breach.

In Quebec there is a consensus that it is needed. In 2011, la Commission d'accès à l'information du Québec published a report in which they said that this is needed. It's a matter of time. It's in the hands right now of the legislature, but we will have also this obligation in Quebec shortly, hopefully.

At the federal level, we've had various bills that have been introduced: Bill C-29, BillC-12, Bill S-4 recently, and Bill C-475. The latest one is Bill S-4. Will Bill S-4 do the job if it becomes law? It's better than having nothing, that's for sure. Maybe it's not perfect, but it's better than having nothing.

I guess it would create the incentive for businesses to disclose, and I think we need to trigger that incentive. In an ideal situation there should be clear monetary penalties for not reporting security breaches to individuals and to the privacy commissioners. There should be a duty to report a breach as soon as possible. I'm cautious with providing fixed delays, because I've been on the other side. Sometimes there's a breach and you need to do the investigation before you start notifying individuals and privacy commissioners, because you need to know exactly what happened and what needs to be told or not told.

The Privacy Commissioner, I believe, should be given the power to order an organization to report a breach to customers. These orders should be made public and the organization should be named. I think that would create the necessary incentive for them to invest in preventive measures, which would be beneficial to address a financial harm resulting form identity theft.

This is my last point. It would not be a bad idea to have a uniform breach notification law in Canada. Various systems could become problematic when there's a breach. I know that a few years ago, the Uniform Law Conference of Canada drafted a breach notification act. Maybe it could be used as a tool.

Thank you. I think my time is up.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, indeed, the telecommunication companies must absolutely act effectively and responsibly towards all those they provide services to. There is no doubt about that.

Equally, we have put legislation before Parliament that further protects the privacy of Canadians, Bill S-4.

The NDP had a private member's bill with regard to the same piece of legislation that did not address this issue, did not even raise the topic, did not offer any amendments, and did not offer any solutions.

Contrast that with what we have done. We have put forward the digital privacy act, consulted with the Privacy Commissioner beforehand, spoken with her all throughout the process, and put forward legislation, which she endorses, that says we will protect the privacy of Canadians.

[James Moore, Conservative, Minister of Industry]

Mr. Speaker, before we tabled Bill S-4, the digital privacy act, I spoke to the Privacy Commissioner and got her views on how to best move forward with modernizing Canada's intellectual property laws.

I spoke to her this morning about the story that has been in the news recently, and in fact here is what she said about our digital privacy act and our efforts to best protect Canadians online. She said, “...I welcome the proposals...” in this bill. This bill contains “...very positive developments for the privacy rights of Canadians...”.

We work with the Privacy Commissioner. We protect the best interests of everyday Canadians, and we are making sure that we move forward to modernize our digital laws.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

My question is for Ms. Lawson because she commented briefly on Bill S-4. However, if other witnesses also have any comments to make I would be happy to listen to them.

Do you think that Bill S-4 represents everything that should have been done to make sure that our privacy legislation is up to date and protects Canadians against these risks in this day and age? Should anything be added to the bill? Does anything not go far enough or is there anything that shouldn't be in the bill?

[Philippa Lawson]

Yes, I think that is problematic. There is a strong incentive for organizations not to report security breaches. So the law, in order to be effective, needs to address that incentive, needs to provide a counter-incentive, and I think that counter-incentive has to be an objective standard that is low enough that they will be reporting all material breaches. That was the standard in previous iterations of this bill. I'm not sure why it's been changed in Bill S-4.

It's a big issue. There are two standards here. There's one for when the organization has to report the breach to the Privacy Commissioner, which is not necessarily public, and there's an issue over whether that should be made public or not, I suppose. The other is when they are required to report it to the affected individuals.

I think it makes sense to have a lower standard for reporting breaches to the Privacy Commissioner, and a higher standard for reporting to individuals. I'm not sure why the government has seen fit to apply the high standard to both. Security safeguards are a fundamental piece of this identity theft puzzle, and organizations play a huge role in this. By establishing an objective standard under which organizations have to report security breaches to the Privacy Commissioner, we will only then have any decent registry or inventory of security breaches, of ways in which organizations are not meeting the standard for protecting personal information.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Ms. Lawson, you stated briefly that the threshold in Bill S-4 for determining whether or not there was a data breach is too high. Under this bill, it is the organizations themselves that decide whether or not to alert the commissioner or the users that there has been a loss of data or a data breach. A subjective assessment is being indicated rather than an objective assessment.

Do you have any comments on that? Do you think that could be a problem?

[Philippa Lawson, Barrister and Solicitor, Associate, Canadian Internet Policy and Public Interest Clinic, University of Ottawa, As an Individual]

Thank you, and good morning, Mr. Chair and committee members.

Thank you for inviting me to address you today on the issue of identity theft. I have been studying and working on this issue from the consumer and victim perspective for over 10 years, first with the Public Interest Advocacy Centre, then with the Canadian Internet Policy and Public Interest Clinic or CIPPIC, the International Centre for Criminal Law Reform and Criminal Justice Policy; and most recently for the Canadian Identity Theft Support Centre.

l've provided a list of publications with my speaking notes today, and I hope that will be distributed to you. These publications include analyses of the range and types of identity-related crime, an international inventory of best practices for victim remediation in both public and private sectors, a gap analysis of legal rights and remedies for victims of identity crime in Canada compared to the United States, and self-help guides for Canadian victims of identity theft. These are all accessible online.

In my capacity as director of CIPPIC, I made submissions to this very committee when it was studying the issue of identity theft back in May 2007. Looking back on those submissions, they are, for the most part, as relevant now as they were then. There have been some developments in the last few years, notably amending the Criminal Code to make it easier for law enforcement to catch and convict identity thieves, which is an important step but only one of many tools needed to address the problem; and also establishing the Canadian Identity Theft Victim Support Centre, which can now be found online at www.idtheftsupportcentre.org, or via its 1-866 hotline. But much more can and should be done to prevent, detect, prosecute, and mitigate the effects of identity-related crime.

I understand that you are interested in the economic impact of identity theft in Canada and that your focus is on privacy or identity-related crime as opposed to mass market frauds generally, or cybercrime generally. I cannot give you any numbers. For the reasons my colleagues have stated, I doubt that it is possible to come up with a good estimate, given the dearth of data on identity-related crime in Canada. Instead, I'd like to use my time just to make five suggestions for policy and law reform in this area.

First, enact security breach notification laws. Individuals can take all the recommended precautions against identity theft, but they can't control what organizations do with their personal data in the custody of the organization. In this age of databases, strong corporate security safeguards are essential to protect against identity theft. Yet, under pressure to cut costs, many organizations are not taking the measures that they should to protect customer data.

A law requiring that organizations report security breaches to the Privacy Commissioner, as well as to affected individuals, would go a long way toward preventing the kinds of security breaches that feed identity criminals. It would also make potential victims aware of their vulnerability, allowing them to take preventative measures before the damage is done. I applaud the efforts of committee member Ms. Borg in this respect, and I encourage the government to consider the private member's bill she has put forward on this issue.

Bill S-4, the new digital privacy act, is a welcome government initiative as it would also require breach notification, but its proposed standard for reporting breaches to the Privacy Commissioner, as opposed to individuals, is inappropriately high, allowing corporations to avoid accountability for inadequate security measures. I know you'll be looking at this bill when it comes before you, and I hope you will look at this very closely.

Second, make data protection laws enforceable. We live in a world of huge and expanding databases of personal information. These are gold mines for identity criminals as well as for marketers, researchers, and even political parties. The Personal Information Protection and Electronic Documents Act, which I'll refer to as PIPEDA, is supposed to protect consumers from the kinds of practices that lead to identity theft and fraud, but practices that violate PIPEDA continue to be widespread in the marketplace. The problem is that PIPEDA lacks teeth. Corporations need not take it very seriously.

The digital privacy act, Bill S-4, would make it easier for the Privacy Commissioner to name and shame corporate offenders. It would also allow the Privacy Commissioner to take action against those who fail to adhere to compliance agreements. These are significant improvements that would make the bill more effective and would be used to hold non-compliant organizations accountable for the kinds of practices that facilitate identity theft, but more could be done to make the data protection laws effective. I hope you will look at all options when Bill S-4 comes before you.

Third, require that credit freezes be offered to Canadian consumers. The messiest form of identity theft is new-account fraud, that is, where criminals use stolen data to create new accounts or take out loans or mortgages in the name of the victim. It can be months before a victim becomes aware of the problem, during which time multiple accounts have been opened and unpaid bills have been run up in the victim's name. Even after the victim succeeds in closing the accounts and dealing with the debts—this is a nightmare in and of itself—the victim can end up paying higher interest rates for years because of their corrupted credit histories.

This may not happen often, but when it happens, it is at a high cost to the individual. By far the best protection against new-account fraud is a credit freeze. A credit freeze bars the credit bureaus from issuing your credit report—the summary of loans and payments that forms the basis of your credit score. Because few lenders will issue credit without first seeing a credit score, identity thieves can't use stolen data to open up new accounts where the credit report is frozen. Credit freezes are particularly helpful for elderly people or for those who don't need to borrow money.

The credit bureau industry has no interest in offering credit freezes for obvious reasons. Doing so would eat into the industry's core business of providing credit reports. However, despite strong industry resistance in the United States, almost all states in the U.S. now require that credit freezes be offered to consumers at no fee or at a very low fee. The reason is to prevent identity theft. There is no good reason why Canadians are not offered similar protection. This is an area of provincial responsibility, but in my view the federal government should be working with the provinces, through, for example, the Consumer Measures Committee to ensure that consumers across Canada have the tools they need to prevent, detect, and mitigate the effects of identity crime, including the ability to freeze their credit reports upon request.

Fourth, coordinate victim assistance initiatives. The Canadian Identity Theft Support Centre, which I'll refer to as the victims support centre, was established in early 2012 with funding from the federal government to provide victims of identity theft with information and support. It has a very specific mandate, and that's all it is. The victims support centre is taking about 10 calls per day now from victims and others inquiring about identity theft, more when there is publicity about the centre. It offers victims hand-holding through the coping and remediation process, which can be extensive.

I understand that the victims support centre provides data to the Canadian Anti-Fraud Centre, but strangely, the Anti-Fraud Centre does not even acknowledge the existence of the victims support centre. Needless to say, there needs to be some coordination and cooperation between these two government-funded agencies so that each can focus on its mandate rather than trying to compete with the other for funds and public profile.

Finally, I would suggest that Canada develop a national strategy for combatting identity-related crime. The four measures I've advocated are just a few of many that are needed to address the many angles of this problem. Canada needs a national strategy to understand and address the specific problem of identity-related crime, a strategy that should be driven by high-level officials and that should involve all key stakeholders. The RCMP's national strategy, which it issued in 2012, is a good start, but it needs a lot more work to get beyond broad generalities and to include the consumer protection angle.

The first pillar of a national strategy should be to develop mechanisms to gather reliable, reasonably comprehensive data on the incidence, types, and costs of identity crime in Canada. On this, I fully endorse the comments of my colleagues, Drs. Sproule and Dupont, on this critical first step in addressing the problem. We need to know the nature of the problem in order to address it effectively. We simply don't have the data in Canada yet.

Finally, sometimes we can learn from our neighbours to the south, and I would suggest that this is one of those times. In 2006, the U.S. President established a special task force to develop a comprehensive national strategy to combat identity theft. The President's task force was co-chaired by the U.S. Attorney General and the chairman of the Federal Trade Commission. It included high-level executives from all pertinent government agencies. Over the course of a year, they examined the problem from all angles and published a comprehensive strategic plan for combatting identity theft in the United States. The plan, which called for a coordinated national approach to policy and law reform, has been largely implemented. There is a lead agency—the Federal Trade Commission—and consumers and victims in the United States now have many more tools at their disposal to prevent and deal with identity theft than do Canadians.

Mr. Chair, and members of the committee, it's time, in my view, for Canada to seize this issue and develop a similar strategy that involves all stakeholders, including consumer protection agencies and privacy commissioners at both federal and provincial levels.

We can do better.

Thank you.

[Dr. Susan Sproule, Assistant Professor, Finance, Operations and Information Systems, Brock University, As an Individual]

Good morning.

My involvement with the subject of identity theft started in 2005 with a research project that involved four universities and subject matter experts from the financial sector. My group was assigned the task of defining and measuring identity theft. On the measuring side we did a comprehensive survey of Canadian consumers in 2008, but that data is really too old to have much value now, so I'm going to concentrate on the definition problem and then discuss some of the difficulties in measuring identity theft. I hope that can help provide some guidance for your study.

To come up with definitions, we started by trying to organize some of the activities that came up frequently when we were discussing identity theft. I had a diagram. I don't know if you've been given copies of it, but basically at the beginning we had a number of activities that described different ways that identity information can be collected. In the middle we had a number of activities that were involved in the development of a false identity, things like counterfeiting documents and document breeding. Then at the bottom we had crimes that are enabled by a false identity.

We were just looking for working definitions that our various research groups could agree on. In a series of workshops, we decided that identity theft should include all the illegal ways of collecting information and all the activities in that development of a false identity. These are preliminary activities to a fraud.

We said that ID fraud should include all the crimes where the use of a false identity was integral to the crime. In other words, you might want to use a false identity if you're smuggling drugs, because that would be useful if you get caught, but you can still smuggle drugs without using a false identity, so we said that's not identity fraud.

I won't go through our formal definitions, but we were quite pleasantly surprised that our definitions ended up to be very similar to those that the federal government's Department of Justice came up with as they prepared the ID theft legislation introduced in 2009.

A key point from all of this is that identity theft and identity fraud are two different problems. Identity theft is a problem of personal and agency guardianship, that is, keeping personal information secure. Identity fraud is a problem of authentication, or being able to determine that the person who is presenting identification is really who they say they are.

Why is this distinction important? You can have one without the other, and vice versa. The thief and the fraudster are usually different people. In general, identity thieves steal identity information and sell it to identity fraudsters. We notice that cases of identity theft—data breaches, etc.—are rarely linked to cases of identity fraud, because there's this middle area that the information goes through.

Primarily, it helps us to focus on the interest and responsibilities of the stakeholders. So, as an identity owner, I can help prevent some identity theft. I can keep personal items that contain identity information secure and not give out personal information unnecessarily. I really have no ability at all to prevent identity fraud. Once my information has been compromised, the only thing I can do is help detect it and report it as soon as possible.

But as an active participant in life today, I really have no choice but to give personal information to all kinds of organizations. These organizations have roles in preventing both identity theft and identity fraud. They can prevent identity theft by keeping any of my information they possess secure. They can prevent identity fraud by ensuring they have proper authentication processes in place whenever identification is issued or is checked.

Organizations are also responsible for detecting both identity theft, when information has been compromised, and identity fraud when these processes have failed and fraud has occurred.

Even within an organization, if you try to interview an organization about identity theft and fraud, the responsibilities for those two problems lie in different areas of the organization. Who is responsible for the guardianship problem? It's generally the security department when we're talking about physical security, and it's the IT department when we're talking about systems security. Who is responsible for the authentication problem? That's anyone who's involved in designing, or managing, or even conducting all the business processes around all kinds of transactions.

On the topic of measuring identity theft and fraud, there are lots of challenges. The very first comes back to this whole problem of defining. A 2006 Ipsos Reid survey found that 29% of Canadians agreed with this statement: “I hear a lot about identity theft, but I don't know what it means.” So if you want to do a survey to find out the extent of identity fraud, you can't just ask respondents if they have been a victim. Many surveys do this, but you really can't interpret anything valuable from these results. In our survey, we gave very specific examples of the various types of identity fraud that we were interested in.

Besides doing surveys, you can look at reports of identity theft to such organizations as the Canadian Anti-Fraud Centre, but the second problem is a general lack of reporting. Credit card fraud and debit card fraud are investigated and handled internally by the credit card companies and the banks. Only a small proportion of those cases are ever referred to police. A Statistics Canada survey on fraud in retail businesses showed that between 40% and 50% of cases were never reported to police. Less than 40% of individual victims ever report to police.

Why does this happen? In general, businesses are afraid of negative publicity. People are embarrassed that they fell for a scam or that they didn't protect their information. I think both often believe that police can't do anything, and they're right, in many cases.

In terms of costs—I gather it's part of your mandate to look at that—the costs of identity theft are many, and they are borne by individuals, by organizations, and by society. Individual victims are not held responsible for financial losses once it's established that a fraud has occurred, but they often have significant costs getting to that point in terms of time and a lot of frustration and anxiety.

Organizations bear most of the monetary losses associated with ID theft and fraud. There are two problems associated with that. First, organizations are very reluctant to tell anybody what these costs are. Secondly, the costs alone don't provide strong incentives to prevent identity theft and fraud.

When an organization has losses associated with identity fraud, those losses are simply passed on to consumers in the form of higher prices, fees, or rates. As well, in Canada the lack of breach notification requirements means that Canadian organizations do not necessarily even suffer from reputational damage. I understand that the proposed digital privacy act will be taking some steps in that direction, and that's a good thing.

There are also general costs to society in the form of a chilling effect. Different studies, including ours, show that between 20% and 40% of consumers say they have adjusted their online behaviours because of a fear of identity theft. This means that Canadian businesses are not benefiting from all of the advantages that electronic commerce should be bringing.

There are two things I would like to see addressed in your study.

First, I would like to see greater responsiveness to consumers by the credit reporting agencies. As I've said, the one thing that individuals can do is help detect frauds, but if we want them to take these steps, they need greater access to and greater control over their credit files. Credit reporting agencies have to provide a free copy of your credit report each year, but they make this as difficult as possible. To get a free copy, you have to fill out a form, copy a multitude of documents, send it all off in the mail, and wait a couple of week for them to mail you back a report. They provide online service. Online service is more secure, and it has to be less expensive to provide, but they'll charge you $24 for that.

As well, both of the credit reporting agencies offer ID theft protection products for $15 to $17 a month. By offering these products, they are profiting from the problem, which provides little incentive for them to reduce or eliminate the threats.

Finally, it's very difficult to manage something if you aren't measuring it. We need regular, periodic data collection in order to identify trends and to design effective educational initiatives and effective policy. Since there isn't one single measure for identity theft and fraud, we believe the real need is for an identity theft and fraud index that would work like a consumer price index or purchasing activity index. This index would bring in information from regular surveys of consumers, surveys of businesses, as well as reports from law enforcement, from credit reporting agencies, from privacy commissioners, victim services, and any other groups.

Thank you for your attention, I hope that's helpful.