Information & Ethics Committee on Nov. 27th, 2014

[The Chair, NDP, Pat Martin]

Good afternoon, ladies and gentlemen. Welcome. Thank you all for being here.

I apologize for missing the first hour. The planning side of the meeting was done away with.

Welcome to the Standing Committee on Access to Information, Privacy and Ethics. We're very pleased to have an hour today with the Privacy Commissioner and officers from the Office of the Privacy Commissioner.

If I can, Mr. Therrien, we have one housekeeping matter that we should deal with first.

There has been a change in the second vice-chair of the committee. The Liberal Party would like to have on the record a new person to take that position. I open the floor for nominations for a new second vice-chair from Liberal Party.

Mr. Menegakis.

[Costas Menegakis, Conservative, Richmond Hill, ON]

I move that Mr. Scott Simms be the second vice-chair.

[The Chair, NDP, Pat Martin]

I see.

Are there any further nominations?

Seeing none, nominations are closed.

Mr. Simms, would you consider accepting the nomination to be the second vice-chair of the Standing Committee on Access to Information, Privacy and Ethics?

[Scott Simms, Liberal, Bonavista—Gander—Grand Falls—Windsor, NL]

In the absence of Arnold and I flipping over it, yes I'll take it. Thank you.

[The Chair, NDP, Pat Martin]

Okay. That's done.

Democracy has been served.

Welcome, Mr. Simms. I'm sure you'll be a valuable addition to the committee.

[Scott Simms, Liberal, Bonavista—Gander—Grand Falls—Windsor, NL]

Thank you, sir.

[The Chair, NDP, Pat Martin]

Having said that, we only have one hour. Are there any other preliminary matters?

Without any further delay, we will introduce the officer of Parliament, the Privacy Commissioner Mr. Daniel Therrien.

Welcome. Mr. Therrien.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Good afternoon, Mr. Chair and members of the committee. I thank you for the opportunity to address our submissions under the supplementary estimates and any questions you may have. Joining me today is Daniel Nadeau, our chief financial officer, and Patricia Kosseim, our senior-general counsel.

I would like to begin by explaining our submissions, and I will subsequently discuss some of our short-term priority issues.

First, let me explain the reason behind what is, in effect, a reinjection of almost $59,000 into our budget. As explained to this committee by my predecessor, our office made a mandatory move from Ottawa to a new facility in Gatineau in February 2014. The move's costs were forecasted mainly based on estimates provided by Public Works and Government Services Canada.

To cover them, the office needed to obtain a $4.1-million interest-free loan from the fiscal framework negotiated through the Treasury Board Secretariat and Department of Finance. We are repaying this loan over 15 years, ending in 2028-29.

The most recent main estimates reflected our first payment in 2014-15 of some $275,000. Since that time, however, the move's costs came in lower than expected. As a result, we returned nearly $900,000 to the fiscal framework, and our annual repayment figure decreased by some $59,000. And it is this latter figure which, in essence, would be returned to our office and be reinvested in our program activities.

I'll now move on to the other item for which we made a submission.

As you know, our office is one of three partners, along with the CRTC and the Competition Bureau, mandated to enforce Canada's anti-spam law. Our enforcement responsibilities under this law relate to the harvesting of electronic addresses in which bulk lists of email addresses are compiled for use by spammers and the collection of personal information by accessing computer systems primarily through what's known as spyware.

In order to gather reports and intelligence regarding these and other activities under the legislation, the government decided to create the Spam Reporting Centre, which is managed by the CRTC. You may remember that it was the government's initial plan to outsource the management of this centre to a private sector operator. However no compliant bids were received, so the CRTC stepped up to take on the role. The CRTC also sought the systems from partners to support the centre's analytical functions.

As a result, in 2011, it was agreed that our office would fund an analyst position at the centre and to that end we signed a two-year administrative arrangement in early 2014. The $125,000 we are transferring to the CRTC pays for an analyst to work on our behalf at the centre. This analyst was in place for CASL's coming into force in July of this year.

Now that the centre is operational, Canadians have been able to submit reports about unsolicited commercial electronic messages. The analyst's work has greatly assisted our office in identifying purveyors of address harvesting. This work has already contributed to identifying potential address harvesting cases for investigation.

Let me now turn to explaining how I plan to align the priorities of the OPC to the new realities brought forth by the emergence of today's increasingly digital economy and society. The digital revolution has truly opened up a new world, one of new technologies that have the potential of bringing benefits to us all. But this new world also comes with new risks for privacy. Take for instance the issue of big data. Rapidly increasing computer power and analytics capacity may help better identify threats and solutions to public health for emergency issues. But it can also lead to decisions about individuals based on inaccurate or incomplete information or data that people may have provided for different purposes altogether.

On top of this, while more information than ever before is being collected and processed, this raises the risk of data breaches calling for greater attention and ingenuity being devoted to cybersecurity. These are just a few of the rather complex issues confronting our office, organizations, and individuals.

Given our rapidly changing environment, we're embarking on an exercise to establish new privacy priority issues to meet the most pressing privacy challenges. In this exercise, our office will be engaging representatives from business, government, civil society, and academia. We will also be consulting focus groups to gauge the views of the general public.

The new privacy priorities resulting from the process will help hone our focus to make best use of our limited resources and further our ability to inform parliamentarians and protect and promote Canadians' privacy rights. I expect this process will be completed by spring 2015, and I look forward to sharing our outcomes with parliamentarians.

Mr. Chair and members, let me conclude now by underlining what lays at both the core of our work and of privacy, overall.

While the world around is rapidly changing, the value of privacy remains timeless. This is central to Canada's privacy laws and, therefore, to our priority-setting exercise.

I want to ensure that we stay ahead of the curve in a complex and quickly changing world, so we can ensure Canadians can exercise some control over their personal information. This will enable them to partake in the digital economy as informed and confident consumers, embracing new innovation with trust, rather than trepidation.

Rather than an impediment, effective privacy protection can and should be an enabler of innovation. It is my hope and ambition that the work of our office will be as effective as possible in helping organizations mitigate the risks of this new world in order to maximize its many opportunities.

Thank you.

I look forward to your questions.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Therrien.

We only have one hour, so we want to move right away to questions. I'm sure MPs have a lot of questions. These are seven-minute rounds and that includes the question and the answer, so I'd ask the questioners and responders to please be concise and crisp in your answers.

First up, then, is Charmaine Borg for the official opposition, the NDP.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

Mr. Therrien, I would like to thank you for your testimony. I would also like to welcome all my new committee colleagues, since this is the first time we are meeting.

In your speech, you said that there are a number of challenges when it comes to privacy. The digital world is constantly changing. The Supreme Court ruling in Spencer is a prime example. You have already underlined that adjustments should be made to the Canadian legislation, particularly with respect to Bill C-13 and Bill S-4.

Could you please provide more detail about your perspective on this matter and tell us what you think the government should do to reduce the ambiguities that followed from the Supreme Court ruling?

[Daniel Therrien]

Thank you for your question.

As I explained before a Senate committee recently, the Supreme Court ruling in Spencer is a very important step forward in privacy law. Before the ruling, it was difficult to know whether the information that Canadians were putting on the Internet could receive strong constitutional protection of privacy. However, the Spencer ruling clearly states that personal information ultimately related to a person's activities on the Internet can in fact receive strong constitutional protection.

There are lessons to be learned from that. Although the Supreme Court did not rule on the evidence required for a government to gain access to information that constitutes a reasonable expectation of privacy, in these conditions, we can expect the government to have access to that information only if there are what we call “reasonable grounds to believe”, which is generally the standard applicable here, and not on suspicion.

I think there is a link between the sensitive nature given to information by the Supreme Court and the evidence required for the government to have access to that information.

I will stop there.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Great. Thank you very much.

Many bills address privacy, including Bill C-13 and Bill S-4. Bill C-44 does not deal directly with privacy, but it expands the mandate of CSIS.

Are you concerned about the lack of parliamentary or civilian oversight related to expanding CSIS' mandate?

[Daniel Therrien]

In my opinion, Bill C-44 has an impact on privacy, in that it directly gives CSIS an extraterritorial mandate. That implies that information is being shared between the secret services and certain foreign agencies. That sharing of information is an issue that affects privacy very directly. That is where my concerns lie.

Obviously, CSIS already receives independent oversight from an agency called SIRC. However, as I'm sure you know, recommendations have been made about this. Particularly in the Arar case, Justice O'Connor highlighted the shortcomings in Canada's independent oversight mechanisms. He recommended that all government agencies involved in national security be subject to independent oversight, much like CSIS.

I would add that Bill C-44 deals with CSIS's mandate and, indirectly, the sharing of information by CSIS. However, it is important to know that the information obtained by CSIS is then shared with some federal organizations, which may not be subject to independent oversight. That is the case with the Canada Border Services Agency, for example. It is this lack of oversight by independent agencies that is worrisome.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Mr. Chair, do I have any time left?

[The Chair, NDP, Pat Martin]

You have two minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Perfect.

[The Chair, NDP, Pat Martin]

The luxury of time.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I would like to come back to Bill C-13 and Bill S-4.

If these two bills remain unchanged, are you afraid they will raise legal issues? Will it have any impact on your office? Will it make your work difficult?

[Daniel Therrien]

If the standard of proof I spoke about—that is, if the reasonable grounds to suspect remain—that would certainly lead to constitutional challenges. There would also be a certain ambiguity or uncertainty for awhile, until the courts make a ruling in that respect. I think that the courts will deem this standard unconstitutional. So there will be some ambiguity or uncertainty during that period.

The other issue that Bill C-13 raises is the immunity clause. Under that clause, telecommunications companies, and others, that voluntarily provide information upon request by the government would be protected by the immunity clause when they provide information that should be protected pursuant to Spencer.

Will the communicated information be shared because it represents a reasonable invasion of privacy? There is some ambiguity there and, until the courts have ruled on these two issues in particular, Canadians will be pretty much in the dark for a certain period of time.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

[The Chair, NDP, Pat Martin]

Thank you.

Perfect timing, that's exactly seven minutes.

Next, then, we'll be going to the Conservatives, led by Mr. Costas Menegakis.

[Costas Menegakis, Conservative, Richmond Hill, ON]

Thank you, Mr. Chair.

Thank you, Commissioner, and to your officials for appearing before us today. I certainly found your testimony very interesting and informative.

The first question I'd like to ask is with respect to the move. There was $4.1 million, a one-time loan. Has that move been completed now? Are you fully operational in your new offices? Is everything operating as you would like it to be?

[Daniel Therrien]

Yes. We're well in place in our new offices, yes.

[Costas Menegakis, Conservative, Richmond Hill, ON]

I noted that one of the comments you made in your presentation was you want to ensure, you say, “that we stay a head of the curve in a complex and quickly changing world.” In so doing, can you elaborate on whether or not you have discussions with other countries, let's just say international friends that we have, in sharing best-business practices and accomplishing the challenge of staying ahead of the curve?

[Daniel Therrien]

Yes. I was at an international conference of privacy and data protection commissioners, in October actually, on current issues or upcoming issues with respect to privacy. The issue of big data was among those discussed, and also the privacy implications of the Internet, which also raises issues with respect to big data analytics. We are in contact with other privacy commissioners, or what are known in other countries as “data protection authorities”, to follow trends and discuss these issues so that we can recommend as good a protection as possible for individuals.

[Costas Menegakis, Conservative, Richmond Hill, ON]

Are there some specific countries that we have very good relations with, that are advanced in that perspective and we can benefit from?

[Daniel Therrien]

Absolutely. There are many countries, over 60, that are participating in this forum of the international conference, and certainly there are many countries in Europe, and Australia, New Zealand, the United States through the Federal Trade Commission, that are good partners in this regard.

[Costas Menegakis, Conservative, Richmond Hill, ON]

I'm sure you're familiar with the report that was tabled by the committee in the House of Commons on April 23 of this year. The report is titled “Privacy and Social Media in the Age of Big Data” in which there are some specific recommendations with respect to the Office of the Privacy Commissioner. Among them are to develop practices that fully comply with the Personal Information Protection and Electronic Documents Act; to develop policies, agreements, and contracts that are drafted in clear, accessible language that facilitates meaningful and ongoing consent; and to put in place mechanisms that ensure individuals have access to any personal information that those companies may hold about them, that limit how long those companies hold on to that information, and that facilitate the deletion of such information.

Do you have plans to take measures to implement some, if not all, of those recommendations?

[Daniel Therrien]

We have certainly participated in this study, and we welcome these recommendations.

I think I will ask Madame Kosseim to answer your question, if you don't mind.

[Costas Menegakis, Conservative, Richmond Hill, ON]

Absolutely.

[Patricia Kosseim, Senior General Counsel and Director General, Legal Services, Policy and Research, Office of the Privacy Commissioner of Canada]

As you know, we did participate in the study, so we were happy to see the report. There are a number of recommendations that we have paid attention to and continue to implement as we can.

Are there some in particular you would like to ask about? I don't have the study in front of me.

[Costas Menegakis, Conservative, Richmond Hill, ON]

In general terms, do you intend to implement some of those recommendations, and where are you in that process?

[Patricia Kosseim]

Certainly, social media in general is a very big priority for the organization. We have particular outreach activities aimed at youth in order to increase digital literacy. We do them in-house or a lot through our contribution program that funds research and public education programs aimed at increasing digital literacy. They've had quite a bit of success in that regard.

It's certainly a big priority of the organization. In fact, it was one of our past priorities. Of the four, it was identity protection and management. This was foremost in our minds and continues to be.

[Costas Menegakis, Conservative, Richmond Hill, ON]

Thank you.

I was speaking with an IT professional in the greater Toronto area who, ironically enough, has personally decided not to engage in any social media because of major concerns he has about privacy through social media. I was kind of surprised that this was coming from him, quite frankly, because he's someone who is very computer savvy and I would think would know how to protect himself in social media.

Can you share with us what some of the challenges are with privacy with respect to the massive social media outlets that are out there today?

[Daniel Therrien]

Certainly, one type of issue is to determine with whom you're sharing information when you use social media. Even if someone wants to restrict the group of people with whom data would be shared, it is easier said than done to actually ensure that this is the case. This leads me to a larger issue, which I'm considering after more or less six months in the job. That is, one of the challenges that social media raises, among other issues, is that we need to think about the relative role of individuals, of organizations, of regulators, like myself, and of legislators in ensuring that the privacy of individuals is respected.

Your question implies that individuals who actually use technology have a responsibility—there is no question about that—but it's not always easy for them to exercise control, because it is not obvious always what will be made of their information. Private organizations have responsibilities and we have a principle under the PIPEDA legislation of accountability, which is extremely relevant to this. It is a principle that I intend to pursue to ensure that organizations do act in a responsible way.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Therrien, and I'm afraid I have to interrupt you. We're well over time.

Thank you, Mr. Menegakis.

For the Liberal Party, we have Mr. Arnold Chan. Welcome.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Thank you, Mr. Chair, and thank you to the witnesses.

Also, congratulations, Commissioner, on your appointment.

I want to follow my line of questioning, in line with where Ms. Borg was going.

First on Bill C-13, you have previously indicated that you were uncomfortable with many parts of the legislation and felt that it should perhaps be split into two bills. Despite those reservations, the legislation has now moved on to the Senate. What amendments would you make to make the bill more acceptable? You also mentioned in your earlier comments that you thought certain aspects might be unconstitutional. What aspects of the bill do you feel are potentially unconstitutional?

[Daniel Therrien]

We made a number of recommendations—

[Costas Menegakis, Conservative, Richmond Hill, ON]

I have a point of order, Mr. Chair. The meeting today is to discuss supplementary estimates. We gave a little leeway earlier, but the line of questioning, asking the Commissioner to pass specific judgment about pieces of legislation....

[The Chair, NDP, Pat Martin]

What is your specific point of order?

[Costas Menegakis, Conservative, Richmond Hill, ON]

I believe the question is not within the scope of today's meeting.

[The Chair, NDP, Pat Martin]

Relevance....

[Costas Menegakis, Conservative, Richmond Hill, ON]

A question of relevance, yes....

[The Chair, NDP, Pat Martin]

I'll just consult with the clerk, if you'll excuse me a second.

I'm sorry, Mr. Menegakis. I'm going to rule that's not a point of order in that we're dealing with the supplementary estimates, which is the budget for the operations of the office. Many of the complex legal issues the Privacy Commissioner has been dealing with lately constitute a real challenge within his office in terms of budget and resources. I think the questions related to recent legislation and recent court challenges are applicable to and have a bearing on the estimates and therefore the budget, so I'm going to let the member for the Liberal Party continue.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Thank you, Mr. Chair.

I've posed the question, so I'll leave it to the commissioner to respond.

[Daniel Therrien]

We have recommended essentially four types of amendments to Bill C-13.

One issue is related to the question of thresholds that I mentioned earlier. The bill currently proposes that access to information under production orders would be on the basis of reasonable suspicion. We recommend that it be on the basis of reasonable grounds to believe. I think that if it stays at the level of reasonable suspicion, this threshold is vulnerable to charter challenge.

The second issue is the immunity clause I also referred to earlier. Here I recommend that the law be clarified so that only in circumstances provided for in Spencer would the state have access to information.

A third type of amendment has to do with the range of public officers who would be authorized to act under Bill C-13. We propose that the range be narrowed significantly.

Fourth, to enhance transparency, we recommend that the use of these powers be the subject of reporting.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Thank you.

Let me pivot to Bill C-44, which significantly expands CSIS' powers. First of all, the matter is now before committee. Have you been invited to appear and to comment on that particular piece of legislation yet, sir?

[Daniel Therrien]

I have not.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Also, you talked about the issue of civilian oversight. What type of civilian oversight do you think should be implemented to protect the privacy of individuals?

[Daniel Therrien]

I think it should be independent oversight, i.e., oversight by a body that is not part of the executive and is independent from the executive. Then you get into questions of mechanics, which I don't have a definitive view on. There are currently three oversight bodies: one for the RCMP, one for CSIS, and one for CSEC. The gap in my view is that certain other departments are not subject to independent oversight for their national security activities. My recommendation is that some independent oversight apply to them, but should it be one of the three or should it be something that would replace the three? I don't have clear views on that, other than the body or bodies in question should be independent from the executive.

[The Chair, NDP, Pat Martin]

Could we stop the clock for a second?

In the interest of saving the Conservatives the trouble of challenging the chair again, I'm going to ask you to be a little more creative in phrasing your questions to tie them, at least indirectly, to the estimates, or at the very least the budget of the Office of the Privacy Commissioner.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Sure, that's fair enough.

I'm going to pivot to a completely different topic or different area. This is a complaint that's come up from the public, including from journalists and others who have gone through the process of doing ATIP requests. The Privy Council Office has often been focused on providing that information in paper format only, as opposed to a soft-copy, machine-readable format, which of course makes it much more difficult to really sift through a particularly large volume of information.

Given your current resources, are you aware of this particular problem, and how would you respond to such an approach by the Privy Council Office?

[Daniel Therrien]

What I would say is that there may be advantages and disadvantages to receiving information in paper form. One advantage might be to ensure the security of the information in question, which certainly is possible to manage if it is received in paper form. That's the point that comes to mind.

But we'll get back to you on your question.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

Okay.

The reason I raise this issue is that we were told by the Privy Council Office that to ensure the integrity of the information, they do not give out digital versions of parliamentary returns. In practice, what this means is that the users of the information have to reconstruct the entire data set and create it in digital form so that we can ultimately search it. That can often introduce transcription errors or other difficulties in accessing information that was not provided originally in digital format.

It sounds as if you view that as a reasonable, valid position to adopt, given the concerns about the integrity of that information.

[Daniel Therrien]

It is an issue that would be a factor in coming up with a position on whether that ultimately is reasonable or not. I would certainly bear that factor in mind in assessing the situation.

[Arnold Chan, Liberal, Scarborough—Agincourt, ON]

For example, would it be relevant to the recent request that's come to your office from the CRA and the recent accidental release of the tax records of certain individuals who had claimed certain deductions with respect to art work?

[Daniel Therrien]

Breaches can occur with paper records or digital records. They're perhaps more likely to occur with digital records.

It would be a consideration.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Chan. That concludes your seven minutes.

Next, for the Conservatives, we have Mr. Bob Zimmer.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Thank you, Mr. Chair.

Thank you, Mr. Therrien, for appearing before our committee today. I certainly don't admire your job in the environment we have today; it's definitely a challenging one. I guess you don't have to wake up and wonder what you're going to do for the day.

We definitely see it on the Hill as well. We want to be accessible to the public, but we are also balanced out with the fact that we have bad people who want to do bad things. It's a balancing act; it's a tough one, to say the least. And to be the people who have to be security, or as you are, the Privacy Commissioner.... It's definitely a challenging environment, to say the least.

I see it being two groups. I just pulled up a CBC article on my laptop, and it said you have just been hacked by the Syrian army. That shows that it affects a lot of us in our daily reading. And it's really everybody. It affects not just people who read the daily news in their homes, but it also affects us as MPs.

Do you have the resources to address these new challenges that you face? I think it said in your report that it presents its challenges, but that there are also good things that can come out of those challenges.

Could you just speak to the resources that you have, seeing that we're here for the estimates? Do you have enough to address this new thing we're seeing?

[Daniel Therrien]

First on the question of security and privacy, I'll just say that ultimately I think it's possible to have both, and that position informs quite a few comments that I have made, whether it's about Bill C-13 or Bill C-44. I think security is obviously very important, and legislators should act to protect the public, but it is possible to have both security and privacy and not one at the cost of the other.

As to the question of my overall resources, if I understand correctly, and whether there are enough resources to do the job, with all the tasks, obviously there are important work pressures that we're facing. My starting point on the question of whether we have sufficient resources is, of course, that I will try very much to achieve our mandate within the budgets allocated to Parliament because, of course, these moneys come from taxpayers and I want very much to be able to achieve our goals within these budgets.

That being said, there are important work pressures, and I'll just name a few. First of all, the number of complaints that are made under the Privacy Act and PIPEDA is growing continually. The government has an ambitious policy agenda, which means that we're called upon to comment on legislation, but also we're called upon to make comments to departments on the proposed procedures and policies. The rapid evolution of technologies in the private sector also, of course, creates privacy risks that we have to react to. As I've indicated to your colleague, it's important to ensure that individuals are able to exercise control over their information, which implies that we have an important public education role that is part of our role. So these are the work pressures.

At this point, I would say that I'm still assessing, frankly, whether we have enough to achieve all of these objectives, but I will try as much as possible to do that. In part, what is at play, given the work pressures, is that we have to be constantly looking for new and efficient methods to do our work. This is something that the OPC has done over the years, and we're still very much in that mode. For instance, investigations, which constitute roughly 50% of our work, are the subject of more efficient processes, for instance, that use early resolution as opposed to a full-fledged investigation into complaints. We're trying to have more efficient methods, and this is working. Productivity is up, there are more files being closed in the office than ever before, but unfortunately, the growth in complaints exceeds the growth in our productivity. That's an issue we have to tackle.

In particular, the number of complaints made under the Privacy Act is growing. Our response times to these complaints is also growing because of the phenomenon I was describing: the growth in complaints exceeds the growth in productivity. In early 2015, we will launch an audit into the activities of that branch to see whether it could be possible to be even more efficient than we are currently.

Essentially, there are important work pressures. My objective is to work within the budget that was given to me. At this point I'm not asking for additional moneys. If I come to a different view, I will let you know.

[Bob Zimmer, Conservative, Prince George—Peace River, BC]

Just on behalf of our side, and likely all of us here, necessity is the mother of invention, and I think you've done well with what you have. Thanks for doing what you do. We appreciate it.

[The Chair, NDP, Pat Martin]

Thank you very much, Mr. Zimmer.

Thank you, Mr. Therrien.

We are switching to five-minute rounds now, so please again keep your questions and answers concise.

Next, for the NDP, we have Mr. Mathieu Ravignat.

[Mathieu Ravignat, NDP, Pontiac, QC]

Mr. Therrien, thank you for being here.

I have a simple question. On the Bill C-44 study in committee, did you request to appear in front of committee?

[Daniel Therrien]

We asked to appear, yes.

[Mathieu Ravignat, NDP, Pontiac, QC]

Were you the main drafter of regulations post-2011 with regard to the sharing of information across borders?

[Daniel Therrien]

Yes.

[Mathieu Ravignat, NDP, Pontiac, QC]

So you're uniquely placed to understand security issues with regard to sharing information. I find it particularly ridiculous and unacceptable that you couldn't appear in front of the a committee discussing these very issues. You are, sir, the expert in this country on these issues and yet we did not allow you to appear in front of committee.

Now I'm going to tie this, because my Conservative colleagues are no doubt getting hot under the collar, to the budget. The reality is that if certain pieces of legislation are fundamentally unconstitutional that creates an incredible burden on your office. Was this part of your worries with regard to Bill C-34 and Bill C-13?

[Daniel Therrien]

Ultimately my concern with respect to Bill C-13 is that although the Supreme Court decision in Spencer clarified many things, it could not and did not clarify every issue raised by this bill. My concern is that the Canadian population will be in the dark as to the level of protection of the information that they put on the Internet.

[Mathieu Ravignat, NDP, Pontiac, QC]

Do you fear that when this legislation gets rammed through by the Conservatives in the House you are actually going to not have the resources to deal with these pieces of legislation?

[Daniel Therrien]

My statutory duties in this regard would be in part on the question of sharing by organization subject to PIPEDA and whether their sharing conforms to the Spencer decision. There could be complaints along those lines.

It would be premature to prejudge whether we'll be able to assess the workload or not.

[Mathieu Ravignat, NDP, Pontiac, QC]

Thank you for that.

The Information Commissioner has come out saying basically that she is strangled and she can't do her job because she doesn't have enough money.

You are being a little bit more generous with your comments, but clearly there is a significant increase in the amount of workload you have. There has been very little increase in your budget. How can Canadians be confident that you have the resources necessary to do your job?

[Daniel Therrien]

At this point, as I have said, we have increased our productivity with respect to complaints in relation to PIPEDA. Our productivity is up and the response time is down and the backlog has been reduced. I think we're going in the right direction. We have some challenges with respect to Privacy Act investigations.

[Mathieu Ravignat, NDP, Pontiac, QC]

There is no doubt, sir, that you are doing a great job with the money you have. My question is that perhaps you are doing what any good civil servant at your level would do, you deal with the budget you have but that doesn't mean you have enough. That doesn't mean you couldn't have more, particularly in a changing climate.

Privacy in this country and in the world has fundamentally changed in its nature and there needs to be proper government investment with regard to the future.

Anyway, that's a comment.

What I find kind of funny in this climate too is that we actually rip $125,000 from your budget to go and give it to the CRTC to deal with spam mail. Why did we take that from your budget? Can you explain why we took that from your budget to give it to the CRTC instead of raising the CRTC's budget to deal with the issue?

[Daniel Therrien]

It is actually at our request that this is being done.

[Mathieu Ravignat, NDP, Pontiac, QC]

Oh.

[Daniel Therrien]

The reporting centre is led by the CRTC and we were asked by the CRTC to contribute to it. We've offered this money to hire an analyst and we are getting the fruits of the work of that analyst in trends or potential investigations into spamming. So I think we're getting benefit from having that funded.

[Mathieu Ravignat, NDP, Pontiac, QC]

Okay. Thank you for that. That is reassuring.

[The Chair, NDP, Pat Martin]

You've got 30 second remaining.

[Mathieu Ravignat, NDP, Pontiac, QC]

I'll try to ask this question in 30 seconds.

I'll switch to French.

The report of the Standing Committee on Access to Information, Privacy and Ethics, entitled “Privacy and Social Media in the Age of Big Data”, mentions the need to “develop practices that fully comply with the Personal Information Protection and Electronic Documents Act, particularly accountability and openness.” It also mentions developing policies, agreements, contracts and so on.

What progress has been made?

[The Chair, NDP, Pat Martin]

If you could, be very brief, please.

[Daniel Therrien]

We are at the analysis stage. We haven't yet made any concrete progress with the guidelines.

[Mathieu Ravignat, NDP, Pontiac, QC]

Why is that?

[Daniel Therrien]

The issue is complex.

Perhaps Ms. Kosseim can provide more detail.

[The Chair, NDP, Pat Martin]

I'm not sure we have time for a complex answer, I'm afraid. I think we're going to have to—

[Mathieu Ravignat, NDP, Pontiac, QC]

Is it because of a lack of financial or human resources?

[The Chair, NDP, Pat Martin]

I'm afraid I'll have to call it quits there. There may be an opportunity in other questions to respond to that, if that's okay with the committee.

Next, for the Conservatives, we have the vice-chair of the committee, Pat Davidson.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Chair.

Thank you, Commissioner and officials, for being here with us this afternoon.

Congratulations on the great job you're doing with a very difficult situation. I can't imagine how you can even try to keep up with the way the digital world is changing so rapidly, so I commend you on the job you are doing. I think it's reassuring to Canadians to know that it's ultimately possible to have security and privacy, and I think you made that very clear.

You talked quite a bit about the increased complaints, the number of new pieces of legislation you've had to comment on, department policies, and of course the new technology. One thing I'm extremely interested in is public education and how that is going.

You also talked about establishing the new privacy priority issues, and the exercise you're going through and hoping to have completed by spring 2015. I wonder if you could give us an update on what steps you've taken so far and who may be involved with this, if it's possible to talk about that. Give us a bit more of an idea about what direction you may be going in.

[Daniel Therrien]

Thank you.

The OPC under Madame Stoddart had four such priorities, and they served the organization very well during her tenure. With my arrival, I think it's timely to modernize these priorities, and it was foreseen that this would be done even before I arrived. I intend to look at these priorities in light of the current environment and the current issues. I want to consult with various sectors in society on what the priorities of the office should be over the next however many years, say five years.

We will consult in five cities across Canada, from January to February or March, with various sectors of the population: certainly the private sector, which would be affected by PIPEDA; civil society; academia; consumer groups; and focus groups of the general population, because I think they too have something to say about what is of concern to them in terms of privacy. We would like to hear from certain representatives of the general population regarding their concerns so that they can be taken into consideration as we develop our priorities. I want to do that in a consultative and inclusive way.

After these sessions, we will sit down in the office and determine how to reflect these comments in new strategic priorities, which goes directly to the subject matter of the meeting today. We want to ensure we are the most effective in how we use our resources, and having modernized priorities will help us focus our activity so that we are as effective as possible.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Can you talk a little bit about anything that might be done now with regard to public education?

[Daniel Therrien]

Yes. We have quite a few activities on that front. For instance, with respect to youth, who are obviously big consumers of new technologies, we have products and we send material to schools and educators, who can use these to inform young people about privacy concerns. We have had many interactions with relatively large businesses over the years. We are finding out that small and medium-sized businesses know less about their privacy obligations than perhaps they ought to, so we want to focus part of our public education activities with respect to small and medium-sized businesses, which hold quite a bit of information about individuals.

[The Chair, NDP, Pat Martin]

I'm afraid that concludes your time, Ms. Davidson.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Therrien.

Before I hand the floor over to the NDP's Pierre-Luc Dusseault we need about two minutes at the end of the meeting to vote on the supplementary estimates, and a motion to report said estimates to Parliament. Therefore, we still have time for one complete five-minute round for Pierre-Luc, but I may have to stop you toward the end to conduct those mandatory votes.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair. I understand your role and that you have to limit speaking time.

Mr. Therrien, thank you for being here, and congratulations on your appointment. I had the opportunity to meet with your predecessor, Ms. Stoddart, a few times. She did a very good job. I am sure you will also meet this challenge. I have a few questions for you about your budget.

Your budget for last year was $29.1 million. This year, the main estimates (B) are $24.3 million, a decrease of $4.8 million. I was quite surprised by these figures.

A little earlier, it was mentioned that the budget had not increased, but had actually decreased. If I understand the numbers correctly, the expectation is that the budget will be reduced.

In 2013, there was a 17% increase in PIPEDA-related complaints compared to 2012. Do you think you have the resources you need to fulfill your mandate, given the reduction of close to $5 million compared to last year?

[Daniel Therrien]

Most of the reduction was related to the moving costs last year and will not come back, except in the form of repayment of the loan, which is about $200,000 a year for 15 years.

However, approximately $4 million that was spent last year will not be spent again. The difference between $29 million and $24 million is about $5 million. In other words, $4 million for the move and another $1 million related to 2012-13 budget cuts and the spending reduction program that affected all federal departments and agencies to the tune of about 5%.

The commissioner's office was not specifically targeted by this measure, but before my arrival, it was felt that the same effort should be made out of fairness. The contribution of the commissioner's office in this exercise is $1.1 million, and that is a recurring cut.

Will it be more difficult to achieve our objectives? Obviously, we will need to increase our efforts to be efficient. In the end, despite the cuts and as a result of the efficiency measures we have adopted, we have been able to increase the productivity of our investigations. So there are more completed investigations than before.

Again this year, we think that the number of completed files will increase, despite these cuts. We think we will be able to meet the demand, despite the cuts in question.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Do you also think you can meet the demand, despite the new legislation and the recent Supreme Court ruling? Do you not foresee the repercussions on your annual budget in terms of the necessary resources, which would mean that you could no longer operate properly in the new context?

[Daniel Therrien]

For the moment we can. In fact, we need to go through this exercise again and again because the demand, the number of complaints, the number of bills and so on is constantly changing. Currently, I think I have enough money to manage, but we need to go through this exercise continuously. Let me link this to establishing strategic priorities, which I just mentioned. We must deal with a certain number of operational activities, which includes studying the complaints that are submitted. It is important to look at bills. It is important to monitor the policy program to make relevant recommendations to Parliament on privacy legislation.

Once we have completed the strategic priority exercise, we will see whether we lack funds to meet all of these objectives. We will exercise our judgment at that point.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Therrien.

That's exactly five minutes right on the button there.

Pierre-Luc Dusseault, we didn't have to shorten your time at all.

With that, we'll thank you very much, Privacy Commissioner of Canada, for being with us here today to speak to your supplementary estimates (B). You're welcome here any time, sir. We look forward to having you appear perhaps the next time you make your annual report to Parliament, if not sooner.

[Daniel Therrien]

Thank you.

[The Chair, NDP, Pat Martin]

Committee members, can I ask you to stay for a moment, please? We have two votes to deal with the supplementary estimates.

OFFICES OF THE INFORMATION AND PRIVACY COMMISSIONERS OF CANADA

Vote 5b—Office of the Privacy Commissioner of Canada—Program expenditures and contributions..........$58,900

(Vote 5b agreed to on division)

Shall the chair report vote 5b under the Offices of the Information and Privacy Commissioners of Canada to the House?

[Some hon. members]

Agreed.

[The Chair, NDP, Pat Martin]

Very good. Thank you very much for your cooperation.

Ladies and gentlemen, we're adjourned, and we'll see you soon.