Evidence of meeting #31 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was business.
A recording is available from Parliament.
10:10 a.m.
Conservative
10:10 a.m.
Liberal
The Chair Liberal Tom Wappel
I love to be provocative, Ms. Ireland. But just to give you another chance to reflect, Mr. Tilson's question was rather interesting, because he suggested this: should the committee consider (a) doing absolutely nothing, or (b) making the act even less onerous? And of course, there was complete agreement from the CFIB. As I understood your opening comments, that is contrary to your opening comments. I wonder if you'd like to comment on that suggestion.
10:10 a.m.
Director, Consumers' Association of Canada
Thank you. We kind of got off on the education end of it.
We don't believe that the act should be made less onerous. We think it should be made clearer, more precise, so that consumers do know their rights and what they can do, where they can go, what is allowed, what isn't allowed. I think a lot of small businesses would like to know what is allowed, what is not allowed, what they can do, what they can't do. Sometimes just knowing “This is what we have to do; okay, that's fine, this is what we'll do”.... Trying to muddy around in an area where there are no real rules and you're not really sure what you're supposed to be doing--“Maybe if we do this, it'll be right, but maybe it won't be, and how do we know?”--is difficult.
10:10 a.m.
Bloc
Robert Vincent Bloc Shefford, QC
Thank you, Mr. Chairman.
I find it very disturbing to hear the comments from consumers and industry representatives. They claim that we may have to wait years to find out what we're going to do about this. I don't see what the problem is.
I think that good old fashioned common sense should prevail. What is personal information? Each of use has a driver's licence. We all have personal information. We know what we're referring to. We also know that certain information such as a credit card number or some such thing should not be disclosed to just anyone.
Therefore, in my opinion, when a consumer discloses personal information to someone, that person should be held responsible. Furthermore, persons or firms to whom personal information has been disclosed become the guardians of that information. If documents are lost, or if some facts are conveyed to other persons, that the individual who disclosed the personal information should be held accountable.
Secondly, the act should contain a provision whereby all costs, including those associated with credit cards, that may have been incurred because personal information was lost should be borne by the company that lost them, and not by the consumer who trusted this business.
What do you think about that idea? The onus should be on the company in question. The owner of a business should be able to protect the personal information of other individuals, of other consumers, as if this was his very own personal information.
10:10 a.m.
An hon. member
Oh! Oh!
10:10 a.m.
Bloc
Robert Vincent Bloc Shefford, QC
I'm sorry for bothering you, but we weren't sure where this was going.
How do you feel about making businesses more accountable for the loss of personal information? Do you feel that they can be made more aware that they have a responsibility here and that they should look at the act to see what they can do? I'd like to get your opinion on this matter.
10:15 a.m.
Liberal
The Chair Liberal Tom Wappel
Mr. Vincent, we appreciate the insight we're getting from you on where you might be coming from when we begin our deliberations.
10:15 a.m.
Director, National Affairs, Canadian Federation of Independent Business
I believe there's responsibility on the business side and on the consumer side. I believe a small business owner collects information that they need to do a transaction that is being demanded by the consumer, and they will use that information to transact that particular service or product. If you start putting limitations on the information they can collect, they may not be able to provide the services or the convenience the consumer demands. I think that's a challenge. I believe most businesses feel they have the responsibility to protect that information. I think we need more time with the current law and education to make sure they understand their responsibilities in doing that.
But I think consumers have a responsibility--and that's where the education component becomes so important--to also know what information to give out and what they perhaps should question. I believe that is also a part of this.
But I do think it's important not to sit there and try to define every piece of information that a business can collect. I think that's a difficult thing to do, because consumers are demanding certain types of information, and it could limit a business's ability to provide the service and may even scare them from providing that service because they can't ask for the information that they need.
10:15 a.m.
Bloc
Robert Vincent Bloc Shefford, QC
I think you've strayed somewhat from my initial question.
If, in order to do business with a company, a consumer must provide his credit card number or his social insurance number, then the onus is on the company, and not on the consumer, to keep track of what happens to this information. As consumers, we comply with company requirements. If we knowingly disclose our personal information to this company, we do so believing that it will handle our personal information in a responsible manner. As consumers, I'm sure you have the same expectations.
Hopefully, you won't find yourselves in a situation where, having misplaced your personal information, company officials wouldn't call you for fear their name would be published in the newspapers. Nor should someone be able to steal your identity and make you out to be a criminal. As a consumer, should you assume full responsibility for this situation, or is the company responsible for misplacing this information?
10:20 a.m.
Director, National Affairs, Canadian Federation of Independent Business
I believe the business has a responsibility and they will do what they can. But if a business loses information because it's stolen from them, for example, it would be difficult for them to know, to go back--
10:20 a.m.
Bloc
Robert Vincent Bloc Shefford, QC
If I've entrusted my personal information to the care of your company, I expect it to remain there and not to be disclosed to anyone else. You become responsible for that information.
10:20 a.m.
Director, National Affairs, Canadian Federation of Independent Business
Yes. And I do believe, unless I'm not correct, the current legislation puts that responsibility onto the employer or onto the business owner, and they are, under current rules, attempting to be able to protect that information as best they can.
When it comes to small business, the fact is that they don't collect a huge amount of information. The information they collect is from people they tend to know and know well. I believe the vast majority of them believe that is information that they are going to protect as best they can. They want to comply by the rules. They understand the need to protect personal information, because they themselves are consumers, and other business is going around everywhere....
I do believe they feel they have a responsibility, and they will do what they can to protect it.
10:20 a.m.
Liberal
The Chair Liberal Tom Wappel
Merci, monsieur Vincent.
Well, we're at the end of our questioners. I would like to thank our....
Une question?
10:20 a.m.
Bloc
Christian Ouellet Bloc Brome—Missisquoi, QC
Yes. Thank you.
Earlier, mention was made of conveying to businesses, both large and small, some knowledge of the act that they are required to enforce. Someone asked a good question on this subject. It was noted that the Commissioner travelled across Canada giving speeches about PIPEDA to keep people informed about procedures that must be followed.
Do you not think the government could take on more responsibility in terms of imparting information about the act to those concerned, using the case of the National Building Code as an example? The federal government publishes the code every five years or so and on that occasion, some representatives crisscross the country to bring people up to speed on any new provisions, even if there are only a few of them.
Some organizations also issue certifications, for example, in the case of ISO, LEED or Novo-Climat in Quebec. For instance, one-, two- or three- hour courses may be given to engineers to provide certifications.
Do you think it would be possible to increase awareness of the act's provisions among small businesses and large companies by providing personal information certifications?
10:20 a.m.
Director, National Affairs, Canadian Federation of Independent Business
I think that would be a very large and difficult exercise, mostly because most small businesses do not carry that much private information. Groups like ours do a lot of work to try to inform our members. What they need are tools. They do not have the time. When you have three employees and you're the owner, to go out and get certified for two or three hours takes away from what you're trying to accomplish that day, and if you're not dealing with lots of information, I don't see that as being a really useful way of helping businesses get in compliance.
It might be a different story if you were a company that dealt with huge amounts of personal and sensitive information, but I think for the vast majority of small businesses out there, it would be seen as another paperwork burden exercise of government and it wouldn't accomplish what it set out to do, in the way it should.
10:20 a.m.
Bloc
10:20 a.m.
Director, Consumers' Association of Canada
It's an uphill battle. Consumer education takes quite a bit of time. It has to be ongoing. It has to be repeated. Unfortunately, every year we get a new batch of consumers, and they all have to learn everything from scratch. In this type of instance, we find that consumers frequently, with privacy legislation or some of the other legislation, don't begin to learn about it personally until it affects them personally. If you walk down the street and ask the first 10 people you come to if they know anything at all about privacy legislation or what their privacy rights are, nine and a half of them will tell you they don't know anything.
Yes, we think there should be education--the more, the better; the more ongoing, the better. But as I said, it is an uphill battle.
10:25 a.m.
Liberal
The Chair Liberal Tom Wappel
Thank you very much.
Thank you very much to our witnesses. This was an interesting panel. We appreciate your coming and giving us the benefit of your expertise and your opinions and representing your respective stakeholders so well today in our hearings.
Before I adjourn, I have a reminder. On Tuesday we'll have only one witness, and that will be the RCMP. I'm going to call the meeting for 9:15 a.m., so if you're here at 9 and you're looking for us, don't be here at 9. It's 9:15 on Tuesday morning.
Thank you. This meeting is adjourned.
