Information & Ethics Committee on May 6th, 2014

[The Chair, NDP, Pat Martin]

Good morning, ladies and gentlemen.

I'll call to order our meeting of the Standing Committee on Access to Information, Privacy and Ethics.

We're here today to deal with the main estimates for a series of officers of Parliament. I welcome them here today. It's rarer than hen's teeth, kind of like spotting a whooping crane, to see an officer of Parliament before our committee, so it's a great treat for us.

The way we're going to conduct ourselves is this. We'll introduce the subject by saying that we are here to deal with vote 1 of the main estimates for the Office of the Commissioner of Lobbying. I believe it's vote 1 and vote 5 under the offices of the information and privacy commissioners of Canada.

For the first hour we're going to welcome Ms. Karen Shepherd, from the Office of the Commissioner of Lobbying.

Ms. Chantal Bernier, of course, is the Interim Privacy Commissioner from the Office of the Privacy Commissioner.

That opens the subject. We'll give the floor to our two witnesses and then allow questioning afterwards. The way we have it in order on our agenda is the Office of the Privacy Commissioner first.

Ms. Bernier, would you like to take five or ten minutes to speak to the main estimates of your department? Welcome.

[Chantal Bernier, Interim Privacy Commissioner, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chair.

Thank you very much, everyone.

Thank you for your invitation to discuss our main estimates for fiscal year 2014-15.

Joining me today is Daniel Nadeau, our chief financial officer and director general of corporate services, along with Maureen Munhall, our director of human resources.

In my time today I want to outline our financial situation, then discuss some of the key challenges we face pursuing our mandate and explaining the actions we have taken to maximize the effectiveness of our resources in order to continually enhance service to Canadians.

Let us begin with our financial situation.

Looking at the numbers, you see a decrease in our resources of nearly $5 million. This is due to two key factors. First, our 2013-14 budget reflected a one-time injection to cover the costs of the mandatory move of our headquarters from downtown Ottawa to Gatineau. This injection came in the form of a $4.1 million interest-free loan, one which we are repaying Treasury Board Secretariat over the next 15 years, starting this year with a payment near $300,000.

The other factor accounting for the decrease is a planned reduction under the deficit reduction action plan. While we were not mandated to make reductions under the plan, in the spirit of collegiality, our office answered the call to adhere to its intent. As a result, we have implemented savings of 5% or $1.1 million per year within our total budget as of this fiscal year. This began with $700,000 reduction per year starting in 2012-13 and an additional $400,000 takes effect this year.

While I'm proud of our contributions to the deficit reduction action plan, it comes at a time when privacy matters continue to be of wide interest to the public. We must ensure that we maintain our level of excellence in this context of reduced resources and increased interest.

We see this rising interest reflected in our statistics. For example, in the last completed calendar year, we saw an increase in complaints under the Personal Information Protection and Electronic Documents Act, going from 220 the previous year to 426 this year. Much of this increase owes to the fact that 168 complaints were all on the subject of changes made by Bell to its privacy policy. These are being handled under one single commissioner-initiated complaint. However, even with these subtracted, we have an increase of 17% from the year before.

We saw the same percentage increase in complaints about federal organizations under the Privacy Act, accepting 1,675, more than 300 of which related to a breach regarding Health Canada's medical marijuana access program. The year before, we accepted 2,273 complaints, nearly one third of which related to the loss of ESDC's student loan hard drive. After subtracting complaints related to these high-profile incidents, we still see a jump of just more than 17% in the public sector.

Added to this, we are faced with a growing number of data breach reports. From business we saw a year-over-year 81% increase of breach reports from private sector organizations. Meanwhile, breach reports from federal organizations more than doubled, to 228. That marks a record high for a third year running.

From these numbers, we must not jump to the conclusion that breaches are increasing. More likely, we may be witnessing an increase in notification, which in fact would be an improvement in compliance.

To continue serving Canadians with excellence, but with no additional resources, as the volume and complexity of our work increases, we have adopted the following measures. In the face of rising data breaches, we implemented a calibrated approach by which we meet each incident with a response tailored to its severity. Under this approach, we determine severity on the basis of the organization's demonstrated accountability along with the risk of harm to individuals.

We have worked to modernize our investigation processes, enabling a proportional approach that matches the appropriate tool per issue we face.

We have a range of tools. For example, we can group investigations as appropriate in favour of broader investigations looking at multiple complaints, as we did in the face of 168 complaints about Bell's privacy policy and the even more numerous complaints we received about ESDC. We can also assign a single investigator to handle multiple complaints from the same individual complainant and deal with these in a single report, wherever possible.

We leverage our domestic and international partnerships to expand our enforcement capacity and achieve more expedient and effective results. We did this with the Dutch data protection authority in relation to an investigation of WhatsApp and are now doing the same with our Irish counterpart on an investigation of Facebook.

We undertake informal activities promoting broad-based compliance, such as the international privacy sweep which we spearheaded last year, promoting 40 organizations to significantly boost their privacy transparency in response to our office's concerns.

We are also developing guidance to share best practices and promote compliance.

Finally, we conduct formal investigations and audits on systemic matters when necessary.

We have made greater use of our early resolution process to resolve complaints, with an increase of 15% in relation to the private sector and 10% in relation to the public sector. This serves to resolve matters to the satisfaction of both the complainant and respondent while forgoing the need for a resource-intensive investigation.

In 2013, we reduced the average treatment time to conclude PIPEDA complaints from 12.6 months to 6.7 months, for a 47% improvement. Under the Privacy Act, the average treatment decreased to 6.1 months, down from 6.8 months in the previous year.

We have also made greater efforts to triage and prioritize the review of privacy impact assessments from federal organizations. These assessments are required under federal policy for any new initiative making use of personal information for decision-making.

We are focusing on initiatives holding the highest significance for the right to privacy of Canadians, ensuring that those with the biggest possible risks receive the greatest attention. As an example, we have struck an internal task force to look specifically at initiatives under the “Beyond the Border” action plan, which involves a multitude of programs with possible privacy impacts on Canadians.

In sum, we face challenges brought forth by the nature and volume of our work amidst a tighter fiscal context, and we are doing so determined to continue meeting the needs of Canadians.

We have developed, and will continue to develop, new ways to make the most efficient use of our resources to do just that. The statistics I just mentioned on our increased workload as well as our recent reports to Parliament—on oversight for the Canadian intelligence community, for example, or on the loss of the student loan hard drive, or our prominent report on findings in relation to Google of online behavioural advertising—demonstrate that we are pursuing our work at a continued high level, with unwavering dedication, under resource pressures.

I wish to take this opportunity to publicly recognize the remarkable hard work and innovativeness of the OPC staff who make this possible.

Mr. Chair and members of the committee, thank you. I forward to your questions. Merci.

[The Chair, NDP, Pat Martin]

Thank you very much, Madam Bernier, for a very comprehensive and brief report.

We'll next hear from the Commissioner of Lobbying, Ms. Karen Shepherd, and then we'll go to questions on either or both of the presentations.

Ms. Shepherd.

[Karen Shepherd, Commissioner of Lobbying, Office of the Commissioner of Lobbying]

Good morning, Mr. Chair and members of the committee.

I am pleased to be here today to discuss the main estimates 2014-15 for the Office of the Commissioner of Lobbying. I would also like to take this opportunity to touch upon my mandate and outline a few of my priorities for this fiscal year.

I am joined today by René Leblanc, Deputy Commissioner and Chief Financial Officer.

My mandate is threefold. I must maintain a registry of lobbyists, develop and implement educational programs to foster awareness of the act, and ensure compliance with the act and the Lobbyists' Code of Conduct.

The 2014-15 main estimates are $4.4 million, which is essentially the same amount as last year. However, since I became commissioner in 2008, demands for more accountability and reporting have been steadily growing. In addition, cost containment measures announced in 2010 have forced my office to absorb salary increases over the last three fiscal years.

In 2011 I conducted a strategic and operating review. This review resulted in a 5% budget reduction starting in 2013-14. I minimized the impact of this reduction by postponing the development of new features in the registration system and by limiting the use of external consultants. System maintenance, however, will continue to be a priority.

The recent government announcement that operating budgets will be frozen for the next two fiscal years will further increase pressures on my ability to deliver my mandate. However, with the efficiencies I have put in place, I believe I can manage.

Of the total 2014-15 main estimates, operating expenditures, including salaries, represent $4 million. The remaining $400,000 is for the employee benefits plan, which is a statutory vote. Salaries represent about 63% of my operating budget. I have a complement of 28 employees. The remaining 37% is for non-salary spending.

The first program I would like to talk about is the registration of lobbyists. This program maintains the online, public registry of lobbyists and provides guidance and support to registrants. The registry is the primary source of information on who is lobbying federal public office holders and about which topics.

This year, my priority for the registration unit is to improve the timeliness of monthly communication reports filed by lobbyists. I believe that transparency is hindered when communications between lobbyists and designated public office holders are reported late. I intend to monitor the situation more closely and to further educate lobbyists about the requirements of the act in this regard.

The education of lobbyists, their clients, and public officer holders is also an important component of my mandate. This is how people are made aware of the act, the code, and their requirements. I believe compliance with the act and the code will be improved through increased awareness. My staff and I meet regularly with lobbyists, public office holders, parliamentarians, as well as academics to help them understand the act and the lobbyists' code of conduct. In 2013-14 we met with more than 1,000 stakeholders. I intend to continue these types of activities.

This year my priority in terms of education will relate primarily to the lobbyists' code of conduct. A consultation process with stakeholders took place between September and December of 2013. I received written submissions from a range of stakeholders, and I held a number of round tables to solicit views on the code. I plan to issue a report on the results of the consultation by the end of May.

The third component of my mandate is to ensure compliance with the act and the code. I do this through a number of compliance activities, including reviews and formal investigations.

Since becoming commissioner, I have initiated more than 100 administrative reviews. I have tabled 10 Reports on Investigation in Parliament, finding that 12 lobbyists breached the Lobbyists' Code of Conduct. I have made 11 referrals to the RCMP when I had reasonable grounds to believe that an offence had occurred.

In July of 2013, there was an historic first conviction for a breach under the Lobbying Act. An individual was fined $7,500 for failing to register his lobbying activities. The act provides me with the authority to prohibit an individual from lobbying for up to two years if convicted of an offence under the act. I decided in this case to prohibit the individual from lobbying for a period of four months.

My priority for the compliance program is to develop a more strategic approach to compliance verification. I will do this by conducting activities such as compliance audits and analyzing lobbying performed in various sectors of the economy. I also plan on improving efficiency by implementing an automated case management system to help manage compliance files.

Finally, internal services support the programs and other corporate obligations of my organization. Approximately two-thirds of the internal services expenditure is for support services secured through formal agreements with other government institutions. This strategy offers access to a broad range of expertise that I need to meet my accountabilities as deputy head.

This year I plan to implement a segregated computer network within my office. This network will not be connected to the Internet and will enhance the security of sensitive information, particularly as it relates to compliance files. This segregated network will provide an ideal platform to implement the case management system I mentioned earlier.

I want to close by saying that I am proud of the work my office has done over the last few years. I have assembled a dedicated team of professionals and I continually strive to allocate my resources in a manner that allows me to deliver my mandate as efficiently and as effectively as possible.

Mr. Chair, this concludes my remarks. I look forward to answering any questions you and the committee members may have.

[The Chair, NDP, Pat Martin]

Thank you very much, Ms. Shepherd, for your presentation.

I'm sure committee members do have many questions for both of the agents of Parliament attending today.

First, for the official opposition, the NDP, Mr. Mathieu Ravignat.

[Mathieu Ravignat, NDP, Pontiac, QC]

Thank you, Mr. Chair.

Thank you for being here. It's a pleasure to have most of you, at least, here in one meeting.

An argument could be made that Canadians would prefer that the government not streamline your offices. You're kind of the front line for accountability; I think of all the places that we could be cutting, it could be elsewhere. I understand that you're doing what you can with the resources you have, and that is admirable, of course.

Madam Shepherd, you mentioned that with the changes to your budget, you could “manage”. To me, and probably not to Canadians, “manage” is not a particularly encouraging word. In what respect do you think the budgetary restraints that you're under will impede your work? What is the most significantly reduced area of spending? And should Canadians be worried about you being able to fulfill your mandate?

[Karen Shepherd]

Well, the strategic operating review that I did in 2011 did indicate, and I've said this before at this committee, that I'm running a very lean and efficient organization.

[Mathieu Ravignat, NDP, Pontiac, QC]

You are indeed; you are indeed.

[Karen Shepherd]

I'm lucky, as well, that I have a very dedicated team of staff who are more than willing to wear more than one hat.

That said, in terms of the strategic operating review, it indicated that I could absorb a 5% reduction in this registration system. What that has meant is that there's no development anymore; I'm now in maintenance function.

In the short term that's sustainable. We have, because of the money we've put in over the years, a very robust system. I have full confidence that Canadians can continue to access the data and so on, but my concern with that is probably the long term, because eventually, with technology advancing.... I no longer have developers working on the system, so that will require that at some point, with the limited discretionary budget I have, some of my priorities will have to in fact go into that system.

[Mathieu Ravignat, NDP, Pontiac, QC]

Will it have an impact on your investigations at all?

[Karen Shepherd]

At this point I would say no, because we've been working on the investigations in terms of making them more efficient. That's one of the reasons for the case management system. I've always said that I take all allegations seriously, and I do. Since I became commissioner I've opened 118 administrative reviews, closed 126, with 11 referrals to the RCMP.

So at this point I do not see an impeding on my investigations.

[Mathieu Ravignat, NDP, Pontiac, QC]

Thank you very much.

My next question goes to Ms. Bernier.

In your report on plans and priorities for this year, we read:

…the OPC has had, and is expected to continue to experience, budgetary reductions. To remain responsive to Canadians, the OPC must look for ways to do more with less.

You say so yourself.

I will ask you a question similar to the one I asked Ms. Shepherd. Do you have the financial resources you need to do your job? If you had more resources, what could you do better or do more of? What kind of pressure does your office currently face because of the budget cuts?

[Chantal Bernier]

Thank you for the question.

Yes indeed, we have been forced to rethink our way of doing things because our budget envelope has been reduced while Canadians' interest in these matters has increased. Maintaining our level of excellence is our priority, of course.

As I said, we have adopted a proportional approach. That is the key. For the public sector, for example, we group together all the complaints about systemic matters. I gave you the example of ESDC, where we received more than 1,000 complaints, all about the same incident. We grouped them together and filed one complaint of our own. That allowed us to conduct one single investigation for more than 1,000 Canadians and to resolve it in favour of them all. We are doing the same thing with Bell in the private sector.

The same proportional approach also applies to evaluating privacy matters. When a department provides us with an assessment, we have to check the impact of its initiatives on privacy. There again, we determine where the biggest risk to the privacy of Canadians lies. We concentrate all our efforts on it.

[Mathieu Ravignat, NDP, Pontiac, QC]

I would like to ask you a more specific question.

The electronic world is changing rapidly. You must do a lot of research in order to understand the new issues. Is that research in jeopardy because of the budget cuts?

[Chantal Bernier]

At the moment, we are managing to make the necessary adjustments. The quality of our research program is really remarkable, as you have probably been able to see if you have looked at our website. At the moment, we are still able to fulfill our mandate in that area.

[The Chair, NDP, Pat Martin]

You have about one minute.

[Mathieu Ravignat, NDP, Pontiac, QC]

Okay.

Will you be able to say the same next year?

[Chantal Bernier]

That is still an open question, but as I said earlier, Canadians have an increased interest in those matters. The vulnerability of the technology means that there are more and more incidents and they affect even extremely sophisticated and responsible organizations.

As for next year, I think we will have to see then. It is clear, however, that the volume and complexity of our workload is trending upwards.

[Mathieu Ravignat, NDP, Pontiac, QC]

Thank you.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Ravignat. That concludes your time.

Next, from the Conservative Party, we have Pat Davidson.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Chair.

Thank you both for being with us, and thanks as well as to your support staff.

First, I would like to thank you very much for the job that both of you are doing in your departments. I think you have operated well, and I think both of you have answered the call to do things in a better way, perhaps, and we've seen the results of that.

I have a couple of questions. The first is for Madam Bernier.

You talked about your mandatory move. I know that when you were here previously this was quite an item of discussion, because at that time it appeared to be a very costly endeavour. Has that move been totally completed, and how did it go?

[Chantal Bernier]

Thank you for that question, because it gives me the opportunity to publicly recognize our staff under the direction of Daniel Nadeau. It went amazingly well. There is obviously a need to adapt. For example, people's personal lives have been disrupted by moving to another location, commuting, and so on. We have moved to an open space, so that requires adaptation from closed offices. However, all in all, it has gone very well.

The one clarification I would make on that is that the move has also shown how taxing it was for the team. We are looking at how we can make sure that indeed we absorb that extraordinary effort that they've made. The people who have made it will need to be supported through the adaptation.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

That's good.

One of the things you said in your opening remarks was that “breach reports from federal organizations more than doubled, to 228”. Then, if I heard you correctly, you also made the statement that breaches themselves may not be increasing, but you think notification is improving and therefore that raises compliance.

Can you comment a bit more on that, please? If in fact that is the case, why do you think it might be happening?

[Chantal Bernier]

Admittedly, that is speculation. I speculate that the reason we have more breach reporting is not because there are more breaches but because there is a greater awareness to report.

The reason we speculate in that direction is this. When we look at the challenges in protecting personal information, it was always there; I mean, it is quite something. However, the awareness towards the preciousness, so to speak, of personal information has really increased, and the demands for accountability on that are clearly increasing.

That is what makes us think that if we are seeing a greater number of notifications, it's because organizations are more and more aware of the moral obligation—not necessarily legal, because there is no legal mandatory breach notification—to notify and that notification is essential to help the individuals concerned to protect themselves should it be necessary.

For example, when SIN numbers or credit card numbers have been exposed, then obviously the data holder who has suffered the breach must inform individuals so that they can take the measures necessary to protect themselves.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

You also talked about the tools you are using, the appropriate tools, and I commend you for the way you are using those tools.

One of the things you talked about was leveraging domestic and international partnerships. Could you explain that a little bit further, please?