Information & Ethics Committee on Dec. 4th, 2006

[Don Brazier]

Oh, I think we've definitely had enough experience.

Our problem is that we think that perhaps there wasn't enough.... Again, I don't want to sound parochial here, but we are just looking at the employee relations issue from our perspective. We don't think that perhaps enough thought went into the design of the provisions back six or seven years ago. We think a humungous amount of effort went into the design of areas of a commercial and marketing nature. It was almost as if the employee relations situation was an afterthought.

I have a railway on one side of me and a broadcasting company on the other side of me, and one thing we all know about is regulation. We're regulated--we probably figure that we're over-regulated--but we know how to deal with a regulatory system.

[Mike Wallace, Conservative, Burlington, ON]

Yes, I've got you.

[Don Brazier]

I mentioned a number of other employee relations statutes at the beginning, and they all bump up against PIPEDA in one way or another. We don't want to try to get away from our responsibilities under the law here, but we do think the law should be designed to recognize that we have other obligations, whether they are under collective bargaining under part 1 of the Canada Labour Code or are dealing with human rights complaints. We just think the laws should interact. That's all we're suggesting here. Otherwise, what we have are complaints under one act that we can't deal with because of the restrictions under PIPEDA.

[Mike Wallace, Conservative, Burlington, ON]

Okay.

I'll ask John.

[John Gustavson]

Early in my remarks I pointed out that for most of the private sector, this came into effect January 1, 2004. It's still very early. There is a lot of learning yet to be done. We think more time has to pass before we really understand whether or not significant changes are needed.

Having said that, I tried to acknowledge in my brief as well that there may very well be appropriate amendments to clarify meaning and intent, areas we're not familiar with and can't really fairly comment on.

The law of unintended consequences is always at work, and there may be enough time, when people have had five years, to suggest appropriate technical amendments to clarify how it's going to work.

[Mike Wallace, Conservative, Burlington, ON]

I have a question for FETCO still.

I think you've provided the most, from what we've seen so far, in terms of amendments--at least ones that are reasonable. We had a delegation last week that was a bit off the wall. These are all changes that are required, based on your input. My main concern is for small business and how much this has cost to implement. Do you have any idea what your larger organizations have been spending to implement PIPEDA?

[Edith Cody-Rice]

Well, we have a very large exemption at the CBC, because information gathered for journalistic, artistic, and literary purposes is excluded from the act. That is basically our core business. So for us it's simply about employees, pretty much—aside from our selling tickets to shows sometimes.

We have a portion of a person who is a privacy officer. We have one person, somewhat more than a clerk—well, a good deal more than a clerk, a professional records manager—who also handles privacy requests. We have a portion of a lawyer. I am the privacy person at CBC. In fact, I'm no longer the privacy coordinator; we now have a compliance officer, Meg Angevine, who's with me in the room, as a privacy officer. Then there is the time spent when all of the other departments—principally human resources and finance—are looking for information.

It's hard to put a figure on it, but I can say, at least for us, who have this large exclusion, that we have about—though maybe I'm being too generous—a third of the time of a senior person, half the time of a more junior person, and probably a quarter of my time being dedicated to this. And then there is the time spent by all the people looking for information.

[Mike Wallace, Conservative, Burlington, ON]

Barbara, do you have any comment?

[Barbara Mittleman]

I would pretty much reiterate that. It's not exactly the same amount of time allotted per person--and I won't go into detail here and I can't give you a dollar figure--but certainly a lot of time and energy is spent in managing and providing opinions under the legislation and gathering the information. That's not to say that some pieces of that are not legitimate and appropriate, but a lot of time is certainly expended and, I would say, should not have to be expended in trying to contort oneself into a law that wasn't necessarily meant to apply to the employment relationship in certain contexts.

[Edith Cody-Rice]

I can say, as Mr. Peterson suggested, that if all of our 10,000 employees did a once-a-year check on the information held on them, we would be utterly swamped. They don't do that, fortunately.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Just anecdotally, I'm guessing that the five-year period makes some sense, because there's undoubtedly going to be an election and possibly a different group of people looking at the legislation. It may very well have been that the committee who recommended five years had assumed the act would be implemented more quickly. I suppose it could have easily been stated that it would be five years from the date of full implementation of the act, but we have to live with the way the legislation is.

We'll go right to Mr. Van Kesteren.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you, Mr. Chair.

Thank you all for coming.

I'm a new MP, and coming from small business, I remember the uneasiness when this act came into being. So I looked at it purely from my perspective. Then of course, as we're introduced to these proceedings and we're introduced to the laws, I can see the other side. So it's very interesting to see all the different aspects and the guidelines, the safeguards.

There's one thing that concerns me, just one thing, and it's the only question I'm going to throw out here. We talked about the employer's responsibility, we talked about the employee's responsibility, and we talked about the rights. The only thing that concerns me is, down the road, have we put together an organization that...? And forgive me for saying this, but it is the only thing that troubles me somewhat—and I would never suspect this from our current Privacy Commissioner. We've met her, and she is doing a great job. But is there a possibility, down the road, that we may create a reign of terror, where the Privacy Commissioner can force laws that are enacted, that obviously aren't going to be...? With the examples I just cited in private business, I've come to understand that those things are really unreasonable to expect, but the laws are there.

Have we put in place any safeguards where the Privacy Commissioner has some safeguards too, so they can't start to put in laws or force things that would make it impossible for a business to continue?

[John Gustavson]

The commissioner has no ability to make law or make regulation or make orders. She is an ombudsman, a privacy advocate. She gives guidance. She does have the power to publicize--which, if you noticed earlier in our discussions, s a very powerful one--to compel compliance with her opinions, but it's certainly open to a company to say it's not going to do what she has said she thinks the act means. The only way she could get a change would be to come back to Parliament. She is an officer of Parliament, as you know, not a government official. And the only way to do that would be to come back to Parliament and make a recommendation for Parliament to take action. That's the only way she could achieve a change.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

So again, the danger then is that.... Madam Rice, you suggested that if a company or a group of employees demanded.... That's the real danger. There has to be a source of the request, and it cannot come from the commissioner.

[Edith Cody-Rice]

For access, there has to be a source of request. And there can also be complaints about the way personal information is being handled. But to be honest, privacy, like access to information, is a records management problem. And the major source of expense for companies--more than administering the act as such, although there is a lot of paper in administering the act--is that you get a request, and in small business you have to have someone send the request to the people concerned, get the information back, reproduce it, review it to see if there are exemptions, arrange to release it. It's labour intensive, but you also need to find your records. And particularly in small businesses and in some large businesses, including government, that is your major problem: finding the records. You need a good records management program to properly handle privacy.

[John Gustavson]

Mr. Chair, just to clarify, I would want to give a complete answer. The commissioner does have the authority to initiate an investigation if she wishes, if she sees something she wants to take a closer look at. But again, at the end of that investigation, all she can do is issue her findings, which are not rulings and aren't binding. They're just recommendations to the company to change. If it was egregious, she could go to the Federal Court, but that court hears the case all over again from the start. It's not an appeal of the commissioner's opinion. It's a whole fresh hearing in court. So there are a few things she could do if she found an egregious situation she wanted to investigate and pursue.

[Barbara Robins]

Just to add to that, if you read section 18 with respect to the audit...[Technical difficulty--Editor]...he or she still has to have reasonable grounds. It's not wide open.

[The Chair, Liberal, Tom Wappel]

Thank you.

Let me ask a question going back to recommendation 13, Mr. Brazier.

It was pointed out that the commissioner doesn't have to issue a report if the commissioner finds the complaint is trivial, frivolous, or vexatious. So there's already something in the statute that uses those words, and there's legal meaning to that and precedents and all that. But one of the things we note here is that only individuals can seek a remedy. What about changing the act to allow an employer, for example, to go to the commissioner for a ruling as to whether or not a request is frivolous or vexatious?

[Edith Cody-Rice]

That could be useful.

[The Chair, Liberal, Tom Wappel]

Thank you.

Are there any other questions from any committee members? Mr. Peterson.

[Jim Peterson, Liberal, Willowdale, ON]

Mr. Gustavson and Ms. Robins, you've had experience not only with the federal law but all the provincial laws that are in effect as well. Have you seen anything in the provincial laws that we should be looking at adopting here? They're not exactly the same.

[Barbara Robins]

No, they're not exactly the same. Of course, they're sufficiently harmonized.

The provincial laws out west have gone a slight step further, for example, in dealing with, if memory serves, what happens to personal information when there's a sale of a business. That's a useful refinement, if you will. But it is something that's perfect for provincial legislation, and so the issue is that it may not even be constitutionally appropriate for this committee to consider.

What I'm trying to say is that there probably are refinements, because with each sort of iteration based on PIPEDA, you identify some of these refinements. But for the most part, they're probably related to provincial jurisdiction, so I would reserve my comments in that regard.

[Jim Peterson, Liberal, Willowdale, ON]

Could I ask you the same question, Mr. Brazier?

You of course wouldn't be subject to any provincial laws, would you?

[Don Brazier]

No. I think we've indicated both in our brief and in the subsequent comments that we believe—specifically because we were asked the question in relation to the Alberta and B.C. laws as it relates to consent and to the formal dispute resolution process—that this legislation is a new generation because it came after the federal legislation, and from our perspective it's a more workable one. As far as we know, the Alberta and B.C. laws are working out okay.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.