Information & Ethics Committee on Feb. 15th, 2007

[Jim Peterson, Liberal, Willowdale, ON]

Then you want a rule that banks can collect SIN numbers but telephone companies can't. Is that the type of prescriptive rule you're talking about?

[Margaret Anne Ireland]

I don't think we need to be that prescriptive, but I do believe we need some better guidelines.

[Jim Peterson, Liberal, Willowdale, ON]

Do you have a suggestion as to what they might be?

[Margaret Anne Ireland]

We'd really like to see some guidelines around certainly saying you can only collect your social insurance number if it is absolutely required for Revenue Canada purposes. You cannot keep credit card numbers in your data banks for extended periods of time. Once you process a transaction, you don't need that credit card number unless there's an ongoing relationship.

[Jim Peterson, Liberal, Willowdale, ON]

What do you mean by an ongoing relationship? A person may use his or her credit card to purchase an airline ticket every eight months. Is that an ongoing relationship or not?

[Margaret Anne Ireland]

Personally I would not consider that to be, but there are people who pay their cell phone bills with their credit cards every month. It is automatic.

[Jim Peterson, Liberal, Willowdale, ON]

That is because they get air miles.

What would be an ongoing relationship?

[Margaret Anne Ireland]

If you are doing a monthly charge, that would be an ongoing relationship. I don't think buying an airline ticket once a year could be considered an ongoing relationship.

[Jim Peterson, Liberal, Willowdale, ON]

Then you would envisage a rule that if you do one or more transactions a month you can keep the person's credit card--

[Margaret Anne Ireland]

If that is an automatic type of thing, a monthly charge, then I don't think it is unreasonable.

[Jim Peterson, Liberal, Willowdale, ON]

What I'd have to do as a business person, if I got a credit card deal, is check every month, and on the 32nd day, if that credit card had not been used again, I would have to purge my records of that credit card number. Is that what you're suggesting?

[Margaret Anne Ireland]

No, but I would think that when a customer cancels their contract, which they have signed for x amount of time where you were debiting their credit card, then you would have to purge the credit card.

[Jim Peterson, Liberal, Willowdale, ON]

That's very different from ongoing transactions once a month. I can understand a law that says, if a person cancels a contract to use your credit card, maybe you'd have to get that out of your system, but--

[Margaret Anne Ireland]

My wording there wasn't specific. In those instances where people charge their cellphone bills, their gym memberships, those are contracts. They are ongoing contracts where they are being charged on an ongoing basis. As I said, once a year or once every eight months, airline tickets or a trip to the jeans store would not be an ongoing relationship. There would be no reason they would require your credit card to be kept for 90 days.

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Tilson.

[David Tilson, Conservative, Dufferin—Caledon, ON]

The chairman is quite right, I should not speak for them, but my perception is that many of the members of Parliament do not know what this legislation is. Many of us don't even know how to pronounce it. God knows what the French speakers think. They may have a debate in the French language on how to pronounce it.

This legislation has been in the works for, I don't know, a couple of years. Last year the commissioner's budget was $6 million. This year it's $16 million, and that is because of the issue that is before us now. A lot of it is.

The commissioner has come and said that a lot of her budget has to do with education, as have the witnesses. The average person doesn't know anything about this, whether you're a big bank or whether you're a dry cleaner somewhere.

There will be all kinds of amendments. The staff is going to prepare us a list of proposed amendments that have come from witnesses. If the thing is too difficult now, if members of the public find it too difficult now--and this is a question for both witnesses, particularly the Canadian Federation of Independent Business--what will they do when we make a whole bunch of amendments? Will we just drive them over the edge? Let alone in cost, in understanding.... People could be violating the law and they don't even know they're violating the law.

My question for you is this. Taking all that into consideration, and taking into consideration the cost to the government, and taking into consideration the cost of educating individual organizations and their members, whether it is chambers of commerce or independent business or whatever, should our report back to Parliament be that maybe we should just wait a little bit? If we make any amendments at all, maybe we should make it less onerous.

[Corinne Pohlmann]

Yes, that is definitely our recommendation. More time is needed to really understand the implications of this particular legislation, as it exists today, on the small business community and on consumers, frankly. I do think education is absolutely the biggest key component of that.

[David Tilson, Conservative, Dufferin—Caledon, ON]

But I went further. I asked whether we should make it less onerous.

[Corinne Pohlmann]

Less onerous? I think there needs to be a simplification in terms of understanding what the obligations are, because the biggest hindrance right now for our members is this policy they have to come up with. They know they have to come up with a policy, a written policy, but they don't know what it entails or how it is supposed to work.

What I think needs to be done is that tools have to be created, or we have to find a way of simplifying it so it becomes clearer what should be part of that policy, and again, without their having to go to a consultant and having to spend thousands of dollars to have them do that for you.

We actually don't mind PIPEDA, to be frank with you, because it is a little more flexible than others. It is a principle approach. It is not prescriptive in nature. But keep it in very plain language.

Our suggestion is to keep it as it is. Let it flow through to Canadian citizens and businesses for a few more years. Allow them to understand what their obligations are. Use the time to educate not just businesses but citizens as well.

I think a big part of this is the fact that individuals want the convenience, as I mentioned before, but they also want their personal information protected. Sometimes you can't have both. You may have to give up one to get the other. I think that's where the challenges lie.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Go ahead, Ms. Ireland.

[Margaret Anne Ireland]

I think, again, that we are almost on the same page. It has to be an educational process. Consumers right now don't know what their rights are. They don't know they can complain. They don't know who to complain to. They don't know what can be done about something if their information is compromised.

In a lot of instances when a consumer's information is compromised, it's not a major crisis. Occasionally it happens that something disastrous goes on, especially in the instance of identity theft. That has unimaginable consequences for an individual's life--for their work, their home, their family, and their marriage. It is very serious.

Do we need more education? Absolutely. We have been doing our best to educate consumers about the act and their rights to privacy, but it's an ongoing thing, and it's slow. It's an uphill battle with this type of thing. What can you do? What can't you do?

[David Tilson, Conservative, Dufferin—Caledon, ON]

Should the commissioner do that or should we pass this on to the consumers?

[Margaret Anne Ireland]

Can the commissioner take on a two-pronged--

[David Tilson, Conservative, Dufferin—Caledon, ON]

Well, I think the commissioner is doing an excellent job, as best as she can under the circumstances, and she is trying to educate the public. She's travelling around and speaking to groups. The question is this. Is it possible for her to provide adequate education, or should we be saying to groups, independent businesses, chambers of commerce--it could be anybody--“You have an obligation to educate your members as well”, and thanking those people?

[Margaret Anne Ireland]

Absolutely. I think we can continue on the same path as far as the education goes, with the Privacy Commissioner doing that type of thing. I don't see a reason to take it from her area.