Information & Ethics Committee on April 26th, 2012

[Chantal Bernier]

So the bill must be looked at through that lens, to precisely ensure that it only targets those who must be targeted and therefore avoid using privacy as a shield for illegal activities.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you very much.

I want to let the committee members know that the report titled “A Matter of Trust: Integrating Privacy and Public Safety in the 21st Century”, which Ms. Bernier mentioned, is available upon request. The clerk will provide you with an Internet link, so you can access that report.

I yield the floor to Mr. Andrews for seven minutes.

[Scott Andrews, Liberal, Avalon, NL]

Thank you very much, Mr. Chair.

Welcome, ladies, to our committee this morning.

During your opening remarks you talked about the over-collection of data. How common is that? There's the one example you gave, but how common would it be across government that some government departments probably do an over-collection of data? Is this something we should be concerned about in some other departments as well?

[Jennifer Stoddart]

That's very difficult to say, across the government. I would say it's kind of a natural tendency. I think one of the honourable members referred to the fact that staff always want to get more information to make sure they're doing the right thing, and that they administer programs and so on. I think a lot of it is extremely well intentioned, but it may not be necessary. As the assistant commissioner said, you have to justify why you collect personal information from people, conceptually and in terms of the Privacy Act.

So what we do is.... The Treasury Board asks organizations that are setting up programs where personal information will be collected to do privacy impact assessments. They're often known as PIAs. It varies by year; we have anywhere from between 60 to 100 PIAs that are sent to us. We don't review all of them. We don't have the resources for that. We review the most significant ones, and then we try to whittle down the over-collection of personal information, where that happens.

[Scott Andrews, Liberal, Avalon, NL]

Are these PIAs common practice? From your experience and from what you've seen, is that being done in all appropriate circumstances?

[Jennifer Stoddart]

I don't believe it's 100%, but I'd say it's for the majority of programs with personal information, especially the ones with sensitive personal information.

The assistant commissioner talked about our work with CATSA. We worked very closely with them on the development and implementation of the body scanner and so on.

So in the majority of cases, yes, it is done.

[Scott Andrews, Liberal, Avalon, NL]

Do you work with the different departments on the disposal of that information? At what times do they have to dispose of the information or provide safe disposal of the information? Is that a concern at all?

[Jennifer Stoddart]

It is a concern, honourable member. One of the audits we did recently showed there were huge problems in the disposal of information by the targeted agencies.

We audit disposal practices from time to time. We remind departments of their obligations, for example, in Industry Canada, to wipe computers clean before they give them to schools, or, in the case of Library and Archives Canada, to make sure the contractor who's shredding the information is actually following the standards of the contract. As I said, then we do a follow-up in the next two or three years to see that the recommendations are being implemented.

[Scott Andrews, Liberal, Avalon, NL]

When you were talking about Google, you mentioned third-party audits and other organizations. What other organizations would you be referring to, like Google, that consumers should be aware of?

[Jennifer Stoddart]

Under the terms of both acts, I can't name or talk about in detail ongoing operations unless it's in the public interest.

What I'm referring to is a new position I've taken in the last year because I'm concerned about the cost of enforcing privacy that is borne by the taxpayers of Canada. I think when we come to the end of an investigation and the company has not worked with us to resolve the problem and is still saying they don't care and they’re not going to do anything, or they say they were in the wrong and they’re going to do something, we should not as a government agency have to go back and audit them. That costs people and time and so on. So from now on, we're adopting a practice that, for example, is frequent with the Federal Trade Commission, one of our American counterparts. If you have real violations of the Privacy Act, PIPEDA in this case, we ask you to go and get a third party to verify that you've fixed it up and sent that back to us.

[Scott Andrews, Liberal, Avalon, NL]

I'm sure you are familiar with, and have seen in the media, the robocalls scandal and the information of voters being given to parties to do other things with.

I understand that political parties don't fall within the guise of a lot of data protection and what they do with their data. Have you been following this file at all? Do you have any suggestions on how political parties could better secure their data?

[Jennifer Stoddart]

I think I would wait until the director general of elections has finished looking into this. But certainly in the past we have met with various members of Parliament, different parties, and we've also developed material on helping MPs secure the personal information of many of the voters they represent.

[Scott Andrews, Liberal, Avalon, NL]

I have a question on Bill C-30. Your counterpart in Ontario, Ann Cavoukian, has been quite critical of Bill C-30, and she's been quite vocal. Do you share some of her comments regarding Bill C-30?

[Jennifer Stoddart]

As I mentioned, we've been following this for three years and have done a lot of substantive work that we have shared with provincial and territorial privacy commissioners. That's why we could together take a position on it. I think there's a common viewpoint among privacy commissioners across Canada.

[Scott Andrews, Liberal, Avalon, NL]

Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you, Mr. Andrews.

Mr. Butt, you have the floor for seven minutes.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Thank you very much, Mr. Chair. I don't think I had a chance to say at the last meeting congratulations on being elected the new chair of the committee.

Madam Commissioner, thank you very much for being with us this morning. In your report you stated that the number of visits to your website has increased by 36% from the previous year. How do you explain that increase? Maybe that's a positive thing because public awareness is much higher. How does the situation influence the information you are then placing online?

[Jennifer Stoddart]

Thank you for your question.

We have made a conscious attempt to develop not only our website but also a youth website. We have a youth blog. We have increasingly invested in online information as Canadians and young people are increasingly online, as compared to reading written material or even watching TV. This is a very good development for us, because in an age when resources have to be counted very carefully, we think that's a very cost-effective way of getting the message out to Canadians.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

My daughters are 12 and 8, and my 12-year-old is tweeting and texting and all kinds of other stuff now. We obviously remind her and warn her to protect her privacy and to be a responsible user, but I am concerned about people's privacy because of the way the Internet and all these other social media sites and so on have evolved. It must make your job increasingly difficult, to draw those distinctions in what should be protected through privacy and what is really there for public consumption.

Are you finding it more difficult to draw some of these conclusions when you're investigating different things, just based on the fact that things are evolving so rapidly online? Are there additional tools you may need to react to the fact that this is the way the world is evolving?

[Jennifer Stoddart]

It's a very good question.

In the time I've been Privacy Commissioner, which is a little over eight years now, yes, things have evolved tremendously. The pace at which we have to rethink and reposition ourselves has just increased exponentially.

All over the world people are looking at what the definition is of “personal information”, what should be public and private, and of course at the same time you have the parallel discussion about open government and all of those developments.

I don't know that there's any one resource that would help us. This is part of our work, but certainly one of the places where we've invested in the last few years is setting up our technology analysis branch. The director is here, if you would like to hear more about what that branch does. And there are six or seven people who are very specialized in information technology who analyze mainly what happens on the web, what's happening with mobile apps, what the implication is, and they advise us on our investigations.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

The second area—if I still have some time, Mr. Chair—I want to quickly touch on is PIPEDA and the parliamentary review that I guess will be taking place imminently.

I remember back before I got to this place, when I was the president of the Greater Toronto Apartment Association. We actually helped our members develop a standard privacy template because they were collecting personal information on their tenants living in apartment buildings.

I'm quite familiar with the rules around PIPEDA and some of the pros and cons of that, and obviously some of the administrative difficulties that does create for some private sector companies that are collecting personal information.

How are you preparing for that review? Do we have any timelines as to how we're relooking at that and what role either Parliament needs to play or what role you are simply playing within your own office to deal with the whole protection of privacy and electronic documents act?

[Jennifer Stoddart]

We have been preparing for the next PIPEDA review for the last three years. We will have completed our final positions, I'd say, by this summer, so I am very interested in your question. I'm really hoping that Parliament will look into PIPEDA. The last review was in 2006, I believe, by this committee.

We are, I guess, a little past due to look at PIPEDA again. We've had some major work done by some law professors. We have complementary work done. We have a lot of developments that have happened in organizations that are like ours in other countries, things coming out of the United States, out of Europe, and so on that I think should inform a review of PIPEDA now. So we're looking forward to that.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Okay.

Is that it, Mr. Chair, or do I have more time?

[The Chair, NDP, Pierre-Luc Dusseault]

Mr. Butt, you have a minute and a half remaining.

[Brad Butt, Conservative, Mississauga—Streetsville, ON]

Have you identified any specific areas around PIPEDA that you would be recommending be improved in the legislation, changed, deleted? Are you at that stage yet, where you have semi-ideas around what you might be recommending to us should there be a formal review of the legislation?