Information & Ethics Committee on Nov. 20th, 2006

[Michael Binder]

They're national, yes. But then I think there's some provision in various states. So you're really talking about complexity. It's very complicated there.

[Jim Peterson, Liberal, Willowdale, ON]

It's also complex for foreigners doing business in Canada, with provincial and federal laws to comply with.

Mr. Chairman, I'd just like to get a sense of how many witnesses.... Have a lot of people applied? How many?

[The Chair, Liberal, Tom Wappel]

Mr. Clerk.

[The Clerk of the Committee, Mr. Richard Rumas]

Approximately twenty, and that includes individuals and groups.

[Jim Peterson, Liberal, Willowdale, ON]

That's a fairly high number for this committee.

[The Chair, Liberal, Tom Wappel]

It surprised me--on this act. I'd never even heard of it.

[Jim Peterson, Liberal, Willowdale, ON]

We would welcome your giving us the names of some witnesses we perhaps should call before us. That would be very helpful to our committee.

[Richard Simpson]

We have a list. We can make that available to the clerk.

[The Chair, Liberal, Tom Wappel]

Is that it, Mr. Peterson?

Mr. Stanton.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chairman, and thank you to our witnesses here this afternoon.

I have only five minutes, so I'll try to get through this as quickly as I can.

I have a question from some earlier comments that were exchanged on this notion of the work product. You mentioned the release of personal information as it relates to medical information for.... Just to clarify, you didn't mean of patients, I assume, but of people involved in the professional activities. Could you clarify what you meant by that? Prescription information, I think, is what you talked about.

You were not talking about prescription information or identifying the individual who is prescribed a certain pharmaceutical. That information is clearly in the personal realm, is it not?

[Richard Simpson]

That's correct. This was more the personal element to that. On one side of this argument was the doctor making the prescription, and his name was there. As I understand it, the key issue was whether that was personal information and should be protected or whether it was a work product, because this is in his capacity as a physician.

[Bruce Stanton, Conservative, Simcoe North, ON]

I appreciate that clarification.

To go to another completely different area, from another committee that I'm working on in regards to the Internet, there is just dreadful use of the Internet in the realm of crime--in this case, the issue of sexual exploitation and human trafficking. The Internet is being used for these scurrilous purposes. I note that under section 7 there are exemptions and consent for issues relating to crime, fraud investigation, law enforcement, security, and so on.

Are there any aspects of PIPEDA that are not working with respect to giving the law enforcement community the access it needs to investigations, prosecutions? I assume there would typically have to be subpoenas or warrants provided before law enforcement could get access, for example, to the names and contact information of certain Internet subscribers. Are there any issues around that, or should there be some improvement of PIPEDA as it relates to allowing law enforcement to do its job?

[Michael Binder]

We have a specific carve-out for investigation purposes and crime fighting. Quite honestly, we have not had any complaints. Anytime there was a deficiency, it was amended. There was an anti-terrorism kind of provision that was passed.

[Bruce Stanton, Conservative, Simcoe North, ON]

That would certainly be important to know, because all of those names and addresses, of course, are kept in the commercial, private companies...in this case, Internet security providers.

Finally, in the area relating to the powers of the Privacy Commissioner herself, as you went through the deck you mentioned there were penalties, remedies, fines that could come into place. I assume that's only through the Federal Court, so her only means to enforce the act is through the courts. I was trying to think of some other examples where there might be other forms or powers brought to the table. Presumably in other departments there are regulations, there are enforcement officers and that sort of thing, people who work in the field, who can apply regulations.

But I'm wondering where we could possibly see some greater ability on the part of the Privacy Commissioner to get results in the field, other than having to resort to the Federal Court. Are there some other examples where an office like this might have better means to do that?

[Michael Binder]

There are quasi-judicial bodies with different powers, like AMPs--administrative monetary penalties, I think they're called, which can actually impose penalties, severe penalties, directly. You would have to have a legislative change to do that.

[Bruce Stanton, Conservative, Simcoe North, ON]

Is that the sort of tool that could in fact be incorporated under PIPEDA, then?

[Michael Binder]

Not right now. You would have to amend the act to actually provide it with that particular power. There are going to be some advocates who come in front of you and suggest strongly that this should be done.

[Richard Simpson]

So there would be a fundamental change to how the act operates, because it does operate now under the ombudsman model, with the Federal Court being the instrument the Privacy Commissioner uses to go after, as I said before, very deliberate and intentional violations of the act. So it's very much the order-making or oversight and redress issue that we talked about earlier.

The one issue that will come up under a scenario of order-making powers is whether you still need to set up some kind of independent body that would actually apply the penalties. For example, the Canadian Human Rights Commission has a tribunal. The Competition Bureau has a tribunal. So you ensure that the investigative body does not have the right to be both judge and jury.

[The Chair, Liberal, Tom Wappel]

Thank you.

I have just one question to follow up on Mr. Stanton's. We recently had a case in southern Ontario, in St. Thomas specifically, where the father was alleged to be abusing his child online. The police were trying to prevent that crime from continuing, so they called the server to ask for the name and address of the person. I gather that there was some reluctance by the server to give up that information. Would the reluctance by the server have been under PIPEDA--by the way, Mr. Simpson, I prefer that pronunciation, so I'll go with you--or would the alleged concern of the provider have been under the Privacy Act? Which of those two would it have been?

[Richard Simpson]

In some cases there is an issue around what constitutes lawful authority. As we said earlier, the act is pretty clear that if you have lawful authority for that information as part of an investigation of criminal activity, national security, or whatever, those requirements are above the protection of personal information. In operational terms, there's sometimes a question about what is lawful authority. Is it a warrant? In some cases on the Internet, when you're moving very quickly, law enforcement cannot produce a paper warrant. Sometimes they're contacting you electronically.

So these are the kinds of issues I think you would hear about if you talked to both privacy advocates and to the law enforcement community in terms of an operational requirement. How do you define lawful authority in a way that ensures that the balance is struck?

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Monsieur Laforest, s'il vous plaît, cinq minutes.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

Thank you, Mr. Chairman. I have two questions for the witnesses.

Mr. Simpson, you tabled a document in which you refer, among other things, to the Quebec constitutional reference. You note the following on page 15:As “substantially similar” to PIPEDA, the Quebec privacy law continues to apply within the province.

Are you saying that if the Quebec law were not substantially similar, it could not continue to apply within Quebec?

My second question pertains to the next paragraph in which you say this:Decision will confirm the federal government's ability to exercise its powers over trade and commerce [...]

Are we to assume from this that a decision will be forthcoming and if so, that a responsible official in Quebec would say that the decision handed down supercedes the federal government's authority in this area? I realize that a decision may not necessarily say this, but isn't there an assumption here that there will be some sort of decision, even though one has not already been handed down?

[Michael Binder]

We've just discussed that point. You are correct. The expression “will confirm” is significant. It will clarify the situation.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

I would have preferred to see “will confirm the limits”.

[Michael Binder]

Or “will clarify”.