Evidence of meeting #33 for Access to Information, Privacy and Ethics in the 39th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
4:25 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
Thank you very much, Mr. Flaherty, for coming in. It is quite obvious that you are probably one of the most knowledgeable persons in this country when it comes to the Privacy Act.
4:25 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
I should get a life, right?
4:25 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
No, because that's how we learn from each other.
I always like to hear from somebody like you and then from your nemesis, somebody who thinks on the other side of the issue. Quite frankly, I get as angry as hell when I think that someone might use my personal information for something other than what I intended it for, and I do want there to be sufficient legislation to protect me from people like that. If the legislation doesn't, then I'll do it myself, and I'll sue the bugger.
One of my tremendous worries, and one of the reasons I got involved in government, is my tremendous fear that by trying to have the government do everything for us, we create a huge bureaucracy, the very bureaucracy that you, as a privacy commissioner, sometimes fought against. We develop huge bureaucracies in every single place, which actually don't speed anything up. They slow things down. I'm not saying that a privacy commissioner should have only 50 people working for him or her, but when I hear you say something like “My God, there are 217,000 civil servants. There are 84,000 people at Canada Post. We have to watch those guys, and you have to give me sufficient resources to do it, and every law and regulation that they pass has to be filtered through us to make sure that it...”, I ask how many people you are talking about.
You had the job before in another province, and you advise the current commissioner on certain things that she needs you to advise her on so she can get things done. You have the ten commandments. I've heard what you had to say. It's obvious to me that you have a pretty darned good idea of how many people it would take for a Privacy Commissioner, under the right kind of legislation in Canada.
In five sentences or less, can you tell me how many people that would be?
4:25 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
If you built privacy risk management into federal government institutions, all 250 of them that are subject to the Privacy Act, the Privacy Commissioner's job would be a lot easier. That's what I'm looking for. Rather than doing original work, she'd be saying “Come and tell me what wonderful things you are doing”. It would be a privacy check-off at cabinet before anything came forward. Members of Parliament and committee would ask if you had talked to the Privacy Commissioner. That's what we need.
I'm as anti-bureaucratic as you are. It drives me crazy when I see the numbers of people it takes to do things.
4:25 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
Thank you. And by the way, I'm not really anti-bureaucratic. I think we need a bureaucracy to run things, but we don't need a system that says the more people you have working under you, the more money we're going to pay you. Everybody is building that empire. That's what we have, and I know that because I worked for the Ontario civil service, and I saw it in my little corner of the creek.
I want to understand, because I think you and I may think very much alike, how we protect an effective, efficient civil service, or bureaucracy, since it all means the same thing. How do we protect ourselves from someone, let's say in finance or health, who says okay, we have this new law that Mr. Flaherty and the commissioner want and now we're going to need somebody who goes over and consults with them, so we're going to have to create this whole new body and have deputies? How do we make sure that although we might not grow the Privacy Commissioner's group of people, that everybody else who has to report to her now is not going to have to have 15 or 20 people working for them to consult with the Privacy Commissioner?
4:25 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
The Privacy Commissioner pointed out to you that every public servant above a certain level has to have human resources and finance training. Do they need privacy training? How do you create a culture of privacy, a culture of concern and awareness of privacy? Who are the champions of privacy in federal government institutions? It's not the deputy minister most of the time. Who is it?
You need privacy champions in place. I'm thinking about what you said about bureaucracy. Homeland Security revealed in the last couple of days that air marshals are being bumped off flights they are supposed to be on because they are on a no-fly list. I just shake my head. That's something we've just been reading about.
When I hear the Department of Homeland Security guy, who sat in front of me and spoke at the privacy commissioners' big international conference, asking why I'm worried about fingerprints, since they're not personal information and you leave them behind as you go around the world, I just shake my head. And he parades around as a bit of a privacy advocate.
I heard his chief privacy officer speak at a big security conference in Victoria in February. It was the most useless stuff I've ever heard. It was totally vacuous.
4:30 p.m.
Conservative
4:30 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
I'm venting.
4:30 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
Yes, but you're valuable. That's why you're here, and I can appreciate you've got some problems with--
4:30 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
Homeland Security. I'm using that as an illustration of bureaucracy.
4:30 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
I have to remember that. I was going to use the “Y” word, but I mean our friends to the south of us--
4:30 p.m.
Conservative
Rick Norlock Conservative Northumberland—Quinte West, ON
I'd just like to know how we can create that lean, mean, and effective civil service.
4:30 p.m.
Liberal
The Chair Liberal Paul Szabo
We'll take it off Mr. Van Kesteren's time.
Okay, that's good.
Mr. Dhaliwal, go ahead, please.
4:30 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
Mr. Flaherty, I also have problems with security agencies when I see a respected member of Parliament being on the no-fly list when that member had nothing to do with any terrorism. I'm going to stay away from this.
4:30 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
No, it was not you. It was one of the other Conservatives.
In her recommendation the Privacy Commissioner said she would like a “necessity test” in the legisltion for the collection of personal information. Could you comment on the current use of this test, where it has been implemented in Canada or elsewhere? Has it proven to be cumbersome, or is it manageable?
4:30 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
You may think I'm going around in circles again, but whenever I fill out a form for an insurance claim, at the bottom it says “You hereby authorize us to send all information” to whoever the hell they want to send it to. I always strike it out and say “all relevant information”.
There are several principles we privacy types are pushing. I want to emphasize that I'm a privacy pragmatist; I'm not a privacy fundamentalist. But I do care about privacy. Those are nice distinctions.
Under the “necessity” principle and the principle of data minimization, you should be collecting personal information only because you need it. It's much too easy to fill out a form. There could be 40 boxes on an electronic form, and the thought is to fill them all out because the information may be needed some day in the future.
If there is a reason for it, I have no problem with someone collecting it. We always watch, for example, people collecting information. Imagine if you went to rent a car and someone had a form at Avis asking for your sexual preference. Huh? Duh.... I see forms collecting information on the religion of lottery winners. What does that have to do with it? Are people going to be smart enough to say, “You can't ask me that. Give me my $10,000 or million dollars”?
This is the kind of stuff that's going on. So we have to put in a “necessity” principle. We have to minimize data collection. We should have to give out as little personal information as possible to do the job when we fill out a form electronically or on paper. When you see things that are asking for a social insurance number, why do they need that?
4:30 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
As you mentioned in your presentation, you are concerned about the privacy rights of all Canadians--as are we, which is why we're studying this particular topic. You say that the Minister of Justice must make reform of the Privacy Act a very high priority. In your opinion, what would it take for him to make it high priority, and what steps should we be taking?
4:30 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
I think you really know better than I do. I'm given to understand....
Mr. Nicholson sat through three years of hearings on the Privacy Act, from 1984 to 1987. He signed on to the Open and Shut report, and he knows that the Mulroney government did nothing, in part because they hated the Access to Information Act. The great heritage from Pierre Trudeau to Brian Mulroney was the Access to Information Act. Nobody likes that.
One of the problems is that the bureaucracy thinks of the privacy and freedom of information acts together. They think they have to fix both at the same time. There's nothing that wrong with the Access to Information Act--I couldn't be here and be highly critical of it--but the Privacy Act is something different. We have to keep them on the Privacy Act focus because of the resistance on the freedom of information side. People don't like open, accountable government.
I happen to have been an information commissioner. I regard my work as an information commissioner as much more important than my work as privacy commissioner, but it doesn't mean the privacy commissioner work was trivial. I did a lot to help open up society in British Columbia so that people could know what was going on. I even opened The Province in Vancouver one day to see all my expense accounts flashed across the front column. It wasn't a charming experience, but it's what happens in an open and democratic society.
4:35 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
Technology changes every day. Do you believe there should be a statutory review of the provisions of the Privacy Act, and if so, how long should it be?
4:35 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
Well, Quebec does it, I'm told, by the commissioner and by her submission, every five years. I think we do something like that in British Columbia and Alberta. It's a good thing to have people come before members of Parliament and say what they think. We were having members of the public, trade associations, automobile dealers, whatever it was, coming to say what they liked and disliked.
I have a rather jaundiced view because I worked three hard years on things that should be done to fix the Privacy Act and the Access to Information Act and nothing happened. There were some policy changes but no statutory changes. I think it was partly because Mr. Mulroney did not like the Access to Information Act, but I'm speculating.
4:35 p.m.
Liberal
4:35 p.m.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Thank you, Chair.
Thanks for coming.
I'm listening to this debate back and forth, and I'm agreeing and I'm disagreeing. Quite frankly, I see your point, sure, but on the other hand, I'm thinking, who cares? Like, who really cares?
4:35 p.m.
Professor Emeritus, The University of Western Ontario, As an Individual
Oh, this is going to be fun.
