Information & Ethics Committee on Feb. 22nd, 2007

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

So you have a solid response to this issue.

[Jennifer Stoddart]

Indeed we do, we're talking about the fundamentals when it comes to giving advice.

[The Chair, Liberal, Tom Wappel]

Thank you, Ms. Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Already?

[The Chair, Liberal, Tom Wappel]

Oui.

Mr. Stanton is next, followed by Mr. Martin.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chairman, and welcome, Commissioner and Assistant Commissioner.

First I'd like to apologize to my colleague Mr. Martin. At our last meeting we were discussing, and I'm going to be talking about, subsections 7(3) and 7(1). The copy of the act I have didn't have paragraph 7(1)(e) in it and the connection with collection of information, going back and referring to paragraph 7(3)(c.1) in this case. I see the connection there now, and much of our discussion was based on it, so I apologize to you, sir.

In regard to this question, though, we spent a considerable amount of time, particularly with the witnesses we heard from the law enforcement community, dealing with this issue in subsection 7(3) with respect to the discretion that is provided to the organization in choosing to release the information or not release it.

The law enforcement community suggested that the discretion that's provided in the fact that it says “an organization may disclose” was particularly problematic. I understand the point that protecting personal information is vital under our civil rights, under the independence of the laws that provide individuals.... There's another factor, though, at play here in relation to safety, which we need to find the right balance on.

We heard some very compelling evidence that suggested that in certain circumstances—for example, involving a real-time Internet service provider and a predator online with a young person, where there isn't the time and where law enforcement needs to intervene to stop fraud, to stop a situation in which the public is going to be harmed—they need the ability to have that information.

We spent a considerable amount of time on this question of “may”. Would it be possible to provide in subsection 7(3), for the purposes of an impending urgency or a vital public safety issue, for the organization to be obliged, and not just have the discretion, to provide this information, so that in fact they would be required to provide this personal information in the context of subsection 7(3)?

[Mike Wallace, Conservative, Burlington, ON]

“Authorized” in subsection 7(3).

[Bruce Stanton, Conservative, Simcoe North, ON]

Authorized? Is that what...?

And they even suggest, yes, to have the law read that the companies are in fact authorized to provide it and are obliged to provide it in these circumstances.

[Jennifer Stoddart]

Certainly anything is possible. That would be possible, but I wouldn't recommend it as Privacy Commissioner.

Let me suggest that Assistant Commissioner Heather Black talk to you a bit more, because she's worked directly on this.

[Bruce Stanton, Conservative, Simcoe North, ON]

Yes, please.

[Heather Black]

In my previous life I was with the Department of Justice and was implicated, if you will, in the drafting of this bill. I've heard all of the arguments from all of the stakeholders and I've heard from the RCMP, and you should know that the industry committee amended the original bill to add paragraph 7(3)(c.1) at the insistence, if you will, of the law enforcement community.

I'm not sure that adding the word “authorized” is going to change anything. The “may” in question is a permissive “may”. “Authorize” means you are authorized to do it. It comes to the same thing. It's semantics; basically you're saying the same thing: you may or you may not. It is up to the organization in question to make that call, as to whether in their view the circumstances warrant disclosing information about individuals to law enforcement without a warrant.

[Bruce Stanton, Conservative, Simcoe North, ON]

On that particular point, because it's a very vital point, do you think it's right in this case—and perhaps this is starting to get beyond the bounds of our discussions here—that we're leaving the discretion, with that kind of decision, in the hands of an organization that, to be honest, may have some interest in not disclosing it?

We heard, for example, that 30% to 40% of these Internet service providers are very uncooperative with law enforcement about disclosing information, for example, about their customers in the case where you have a crime being committed. In fact, they're not interested in having any cooperation in terms of public safety.

We're getting into a balance here of public safety versus disclosure of information.

[Heather Black]

I have not heard anything from anybody suggesting that ISPs are reluctant to disclose information in these kinds of circumstances.

[The Chair, Liberal, Tom Wappel]

We heard that evidence.

[Heather Black]

On the ISPs in question, there's a handful of them, when you get right down to it, that provide these services across the country. They are large corporations; they are reputable corporate citizens.

It seems to me that it's a bit of a slippery slope on the privacy side if you start suggesting that organizations should give up personal information to law enforcement in some of these circumstances where it would be entirely possible to get a warrant.

Speaking for the Office of the Privacy Commissioner, I would not advocate such a change.

[The Chair, Liberal, Tom Wappel]

Thank you.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

[The Chair, Liberal, Tom Wappel]

Thank you.

It's a very interesting discussion. How do you get a warrant when you're looking for an Alzheimer's patient who wandered away from an old folks' home? They're trying to get information about who the person is and where they live, so they can find out where they might be wandering to. I don't see how you'd get a warrant.

Mr. Martin, you have five minutes.

[Pat Martin, NDP, Winnipeg Centre, MB]

Perhaps the commissioner wants to answer your intervention, Mr. Chairman.

I'm interested to hear what she has to say.

[Jennifer Stoddart]

I would like to intervene in your last example, Mr. Chairman.

We suggest that for issues of public safety, humanitarian reasons, and so on, personal information should be shared without consent.

That is far different from the law enforcement public security issue. In our systems, we have judges who are always on call, and certainly large corporations have lawyers to advise them.

I wanted to reassure you on that point.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Mr. Martin.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you, Commissioner.

It's a pleasure to see both of you again.

Thank you, Mr. Stanton, for the clarification of our conversation in the last meeting. I'm partly to blame because I was unable to cite paragraph 7(1)(e), which I was referring to. I had everything but the number, and then you didn't have it here.

I think we understand each other now. I sense everyone understands the possible problem we were trying to point out. Our source was the information brought to this committee by the commissioner in November 2006, where it was quite clearly cited as a very real problem and concern.

You said you asked for its removal at the time the Public Safety Act was debated. Have you ever publicly called for its removal from PIPEDA, prior to November 2006?

I guess you couldn't have, as there wouldn't have been an opportunity.

[Jennifer Stoddart]

I believe that in that presentation I made, I continued to mention that we thought it was a disturbing trend that corporations basically had police and national security powers.

[Pat Martin, NDP, Winnipeg Centre, MB]

To be deputized, is the language you used.

[Jennifer Stoddart]

Yes, it's a very disturbing trend from a privacy point of view, and I would refer to that event. It's been a constant position in my office since 2004.