Information & Ethics Committee on Nov. 20th, 2006

[The Chair, Liberal, Tom Wappel]

All right, thank you.

[Richard Simpson]

We can make our affidavit available to the committee, if you wish. It's quite a good read, I have to say, in terms of the history of privacy legislation in Canada.

In the next slide, slide 16—

[The Chair, Liberal, Tom Wappel]

I'm sorry, Mr. Simpson. Again, forgive me. You were just in the middle of slide 15, and at the bullet point you say, the decision “will confirm the federal government's ability to exercise its powers over trade and commerce”. Don't you mean that the federal government hopes that the decision will confirm...?

[Richard Simpson]

Really, we meant the word in the sense of clarify the federal government's power in respect to trade and commerce in relation to provincial jurisdiction over property and civil rights.

[The Chair, Liberal, Tom Wappel]

If the Quebec government were to disagree with the federal government's affidavit, the whole basis upon which PIPEDA has been designed, based on your second slide, goes down the toilet.

[Richard Simpson]

That's correct.

Slide 16 points out, and the committee should be aware, that there have been several modifications to the original law that have occurred since 2001. They're outlined there. Most of these respond to public safety requirements post 9/11, but there is also one revision that relates to the Public Servants Disclosure Protection Act, which will be amended by the Federal Accountability Act, which is now before Parliament, as you know.

That takes us to the parliamentary review itself, and if it's helpful, Mr. Chairman, we can share with you and the other committee members some of what we heard during informal consultations that we conducted over the last couple of years as the date for the review approached. These are outlined very briefly in the next couple of slides.

Overall, the consultations we undertook confirm that the privacy community basically believes that the act is working quite well. You'll see two quotes there that we picked up during our consultations, from the Information Technology Association of Canada and the Canadian Bankers Association, that confirm that.

Some minor amendments were suggested during those consultations, and some issues have been drawn to our attention relating to the state of privacy in Canada, not just to PIPEDA in the strict sense. The capsule summary of those comments is in slide 20, followed by slide 21.

[The Chair, Liberal, Tom Wappel]

Mr. Simpson, again, forgive me. Just so that the record is clear, you said—our researcher just whispered in my ear—that the privacy community believes it's working well. Did you mean the privacy community or did you mean the business community, or did you mean both?

[Richard Simpson]

No, we do mean both. Certainly there's very strong support from the business community. As we get to talk about the powers of the Privacy Commissioner, you'll see that in the privacy community, generally speaking, the business community is very supportive of the existing role of the Privacy Commissioner, and you will hear from other members of the privacy community that even though the act is a good basis for protecting privacy in Canada, they have advocated some stronger powers for the Privacy Commissioner. You will hear that discussion, I think, as you call more witnesses.

[Michael Binder]

Most of the input was about improving the act rather than saying what is not working, but there are different opinions as to what the input might look like.

[Richard Simpson]

Absolutely.

As I mentioned, if you go to slide 20, one of the key issues is the role and powers of the Privacy Commissioner. You will hear from the commissioner herself quite soon, and she will certainly talk about that.

Another issue that has been brought to our attention will be called transporter data flows by some people. It's really the international dimension to the protection of privacy and the need to look at issues surrounding the increasing outsourcing and offshoring of data processing and therefore personal information. But there are a number of technical and definitional issues that have been brought up. The Canadian Bar Association has made a number of suggestions along those lines.

Looking at slide 21, continuing with some of the areas that will come to your attention that we have heard about, the employee-employer relationship and personal information having a different dynamic in an employer-employee relationship than it does in the commercial marketplace is certainly one issue that will be raised. There have been calls to remove privacy protection for employee e-mail and fax numbers, and this goes to the definition of personal information and whether or not it's like a telephone number and you need to protect employee e-mail numbers. Isn't it contact information, much as a telephone number is?

As for mergers and acquisitions, you'll certainly hear from witnesses regarding the need for flexibility in terms of due diligence relating to mergers and acquisitions. Again, you'll probably hear different views on that.

There'll be many suggestions regarding the definition of work product as something distinct from personal information. This is a technical issue that does have some significance in a number of sectors of the economy, and we can talk about that if committee members wish.

These are very likely the issues on which you'll hear a lot more from others, starting with the Privacy Commissioner, who has views on some of these issues. As the final word, the bottom line so to speak, the last slide points out some of the commendations or testimonials on the privacy regime in Canada that have received very high grades internationally from the business community, as you'll see in those quotations. Some of you may have seen The Globe and Mail article about two or three weeks ago that reported on a study by Privacy International, which is an international group advocating stronger privacy protection across a number of countries. It ranks Canada and Germany with the best grades for privacy protection in the 30-plus countries they examined. So we do have a good basis on which to work, in our opinion.

Thank you.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Just for committee members' information, I noticed the last quotation on page 22 is by Ray Protti. Many of you haven't been around as long as I have, but for your information, Ray Protti used to be the head of CSIS. If anybody would know what privacy information is good, it would be the former head of CSIS.

We are reviewing this, and before I go to questions, I'm going to ask the department this. You have had five years of talks with stakeholders. You have mentioned some of the issues that have come up. However, you haven't given us any indication of what the department's opinion is as the department in charge of this act in terms of those issues, and whether you particularly, as a department, have any recommendations for our committee. We don't necessarily have to take them, but naturally we would be interested if you do have some recommendations, particularly since you've been dealing with this act for five years with the stakeholders. I don't know if you're ready to tell us about that or if you've even thought about that, but I'd certainly invite you to think about it. If there are areas of the act you are in agreement with stakeholders and suggesters on, it would be appropriate if you told us that the department believes that X, Y, and Z is a reasonable approach based on five years of experience or whatever reasons you have, and that way, we could consider those items as we go through.

Has any thought been given to that?

[Michael Binder]

Let me say it this way. Five years sounds like a lot of time, but I have to tell you the actual law experience is only very recent. It look a long time to operationalize, for example, what is consent, how do you get consent, etc. The health sector didn't come on board until 2004. So it's only one and a half years, and that was a big carve-out.

Last but not least, that's not the way we normally operate. What we look for in this committee is to do this public consultation and provide advice to us, where then we'll take this through our internal processes, and if there is going to be any amendment following up, it has to go through our internal processes, go up to cabinet and legislation.

So I'm not trying to duck the question. I'm just trying to look for your guidance and advice after a formal hearing of inputs into our processes.

[The Chair, Liberal, Tom Wappel]

All right.

I think my point was that if somebody had come to you and said X, and you fully agree with it and you think it would make sense for the committee to recommend an amendment to that regard, it would make sense to me that you would put that forward. I urge you to consider that. We may have you back later on, after we've heard from some of the witnesses.

We'll start with Mr. Dhaliwal.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

Thank you, panel, for coming out and giving us a talk on PIPEDA.

You say there are four programs here that already have similar legislation in place, so this does not apply to them, right?

[Richard Simpson]

It does not apply with respect to the collection, use, and disclosure of personal information within those provinces. So the cross-border aspect of data protection still remains within the federal purview. So for example, the Privacy Commissioner in British Columbia has full authority to investigate complaints there and exercise all of his powers in relation to any privacy issues within the province of British Columbia. If it was a complaint about a collection of personal information from a B.C. resident, but it had taken place by an organization in another province, then that would go to the federal Privacy Commissioner and she would exercise her authority.

I should mention that there's very close cooperation between the privacy commissioners across the country. All four privacy commissioners in Ontario, Quebec, B.C., and Alberta, but particularly the three that have comprehensive privacy protection laws, collaborate very closely on an operational level with the federal Privacy Commissioner. She will tell you more about how that works. But that's one of the ways in which they ensure that there are no gaps between their respective jurisdictions.

[Michael Binder]

Mr. Chair, if I may, our original intention was to make sure that the business community doesn't have a patch of different rules across provinces. Business is more and more becoming national and international. In fact, we did emphasize that nowadays if you want to do business in Europe you have to have a piece of legislation that's acceptable to Europeans about protecting personal information. In fact, they went through our bill and they actually deemed it to be acceptable. So you can do cross-sharing of databases and information. They are quite happy with our legislation as is.

The same thing goes within a province. We didn't want one business to have onerous requirements in one province that are different from those in another province. That's why we established this national minimum standard, those 10 code provisions to try to put a national standard without imposing the specific on individual provinces in terms of the way they manage their own privacy issues.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

When we look at today's emerging markets, today's emerging globalization, is the data that we collect also used for research purposes, or is it totally used for commercial activity? From your perspective, how much is it used in the commercial activities and how much is it used in the research activities?

[Michael Binder]

There's a two-key system here. It has to be personal and it has to be commercial for this act to apply. If it's not commercial, then the act does not apply.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

So that means it has to have both personal and commercial together. Or can it be either one?

[Michael Binder]

Right. Both.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

You said the latest group to come under this act is the health sector, right? You have the work product there. Could you go to the bottom of page 21 and elaborate on the work product and how it plays into this?

[Michael Binder]

There was a big debate. We use the example of whether a physician's prescribing patterns are private information for the physician or if they're private for the patients? There's a big debate about that, and presumably the court will determine what the outcome is.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Where do you stand on this, if you take this particular issue? If we look at the health community now, they are collecting the data. That's why I want it to come down to this particular issue here. On one side, it is the agencies that collect the personal information. On the other hand, it is the research and commercial activities based on those data structures that we have. And a third aspect is the physicians. By how much do they differ on this one, from all three perspectives—research, the agencies, and the physicians and their patients?

[Richard Simpson]

To go back, the premise for the legislation is based on the idea that it has to be personal information and it has to be commercial. There are a number of exceptions. Information that's collected for journalistic and artistic purposes, for example, is not captured by the act. It's exempt from the act. There are also a number of exemptions for particular types of research activity, even though scholarly activity is exempt from the act as well, correct?

There's a much broader definition of research for most people. Some research may be commercial. For that purpose, there are certain exceptions in the act for what I'll call commercial research purposes.

To get back to work product, I think you're right, it's a central issue around some questions in the health sector about the extent to which personal information is either protected individual information or work product information. You'll hear from witnesses that some provinces have looked at defining work product in such a way that it takes it out of the domain of personal information.

With respect to PIPEDA, a series of court judgments have defined personal information in such a way that certain types of data—like prescription information, if I'm correct—have been defined as not being personal information. In the federal law, we have not yet defined work product so that this area was exempt from the definition of personal information. Some provinces have. You will hear from some witnesses that there is merit in that approach. Others may have a different view.

So that's one approach. In terms of PIPEDA, essentially we in the health sector, at least, have gotten to a similar position due to court interpretations of the law.

I don't know if any of my colleagues want to elaborate, but that's how I see it working right now.

[Michael Binder]

I'm also told that the Privacy Commissioner deemed work product like this not to be personal.

We also have a carve-out for purely research data; that is, for pure research that is not in the commercial domain. Again, the act doesn't apply to it.