Industry Committee on Feb. 5th, 2015

[Chris Padfield]

I think the deputy covered it fairly well. The other thing to remember here and at all times is that the underlying principle of PIPEDA is openness. In any circumstance, if there are any Canadians ever concerned with how their information is being used by a private sector organization, this overlies everything there is in this provision.

Canadians have to be given full access to their information. They have to be able to assess its accuracy and corrections have to be made, so that if Canadians are ever concerned at any time, it's the ultimate oversight.

PIPEDA is designed to give Canadians that authority for themselves so they can go and ask any organization that has their information to see what information they have and to share its accuracy. If they don't get that information, they can go to the Privacy Commissioner, make a complaint, and the commissioner can go forward.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you for the explanation.

You said that people could always file a complaint with the commissioner, but one of the underlying principles of the bill is to ensure that Canadians have the information they need so they can take the necessary steps to protect their privacy.

If organizations are sharing information about an individual without their consent, how can that person take steps to protect themselves? First and foremost, if I find out that my personal information has been shared between organizations at whatever level and that my information may be at risk, I would be the first to want to take steps to protect myself. But all of this is going on without my consent, without the consent of the person concerned.

Don't you think that—

[The Chair, Conservative, David Sweet]

We're over time, Monsieur Dubourg.

[John Knubley]

Basically, the act and amendments impose obligations of that nature on organizations. Bill S-4 sets out new obligations.

[The Chair, Conservative, David Sweet]

Madam Gallant, for four minutes, please.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you, Mr. Chair.

For you, Mr. Knubley, we had Peggy Nash asking a question and she cited a number of clauses from legislation as to when the information on customers would be shared. What it sounded like was that during an online transaction the reference may have been made to PayPal, iTax, or credit card companies allowing them to share, for that transaction only, the information.

While you gave a very succinct answer on how it comes into line with provincial legislation, I'm wondering if you could tell me if, for the purpose of purchasing online, that's why those references are made.

[Chris Padfield]

For those specific provisions, currently under PIPEDA there's a regime called the investigative body regime. It lists a number of entities that are allowed to do these activities now. The range of entities that are there are, for example, the bank crime prevention organization that works for the bank association. They share information back and forth among banks around people who have been robbing ATMs. They have videos at ATMs. They use and share that information without the thieves' consent so they can identify and do an investigation into the crimes. I've visited them. They share information across the country from different banks on people who are stealing from ATMs or robbing right inside the location. It's that kind of sharing we're talking about in that context.

Under the current investigative body regime there are those kinds of sector organizations. Then there are professional associations, such as professional engineers associations, colleges of physicians and surgeons, and the Law Society of Upper Canada, that do investigations into their own members in assuring that their own members are following the code of conduct for their organizations.

You have a third grouping such as forensic auditors who do that kind of activity on behalf of somebody else.

They share information without consent in the course of investigations. These investigations are generally for other public policy purposes in protecting Canadians from crimes, as in the bank example. That kind of information gets flowed back and forth.

What Parliament recommended in the first review of the act was to take an approach of regulating the activity rather than regulating the specific entities, which is the approach that B.C. and Alberta have taken. Rather than having the prescribed list of organizations that has to be updated—if you change your name, you have to go through regulation to have your name changed in the regulation—they said regulate the type of activities rather than regulate the individual entities and put them all on a list in the back.

That's what S-4 has done. It's taken that investigative bodies regime and split it into these two other sections to go and regulate the type of activity rather than the bodies themselves. That's what Parliament recommended and that's what B.C. and Alberta do now.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Okay, and of course no legislation happens in isolation and we currently have the anti-terrorism legislation before us. With that proposed legislation and PIPEDA, confirm for me that should information be required from a company there would be a warrant required for that purpose. Or is that the automatic sharing you're referring to as well?

[Chris Padfield]

They are completely separate pieces and not related. The anti-terror law is about exchange of information within government. This is about private sector privacy rules. They're quite separate pieces.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

To answer my question would a warrant—

[John Knubley]

To answer your question I think the first step is always to ask if there is a warrant. The next step is to ask if there are any limited areas where consent is not required, and there are some very specific areas where that applies. That's the way the digital privacy act works.

I should be clear that this law does not apply to the police. This is a law that applies to the exchange of information from businesses to citizens.

[The Chair, Conservative, David Sweet]

Thank you very much, Mr. Knubley, Madam Gallant.

Now to Ms. Borg for four minutes, please.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

I'd like to come back to the last line of questioning.

I realize that exceptions can be warranted, as you explained, and that's okay. But it opens the door to abuse. We've seen it repeatedly. PIPEDA currently sets out exceptions. Government agencies have made at least 1.2 million requests for information to Internet service providers. So the provisions in PIPEDA have already led to abuses.

And now we are opening the door to more potential abuse. I realize a specific intention is underlying these amendments, but it's very problematic when you open the door up to abuse. I think Canadians want a system that doesn't lend itself to abuse.

Do you think the bill gives them that assurance?

[John Knubley]

Yes, that assurance is there. I will explain again. The act already sets out exceptions. Amendments are being made, but the exceptions are already there.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

My other question has to do with the mandatory breach reporting mechanism.

In your opening statement, you said you wanted to provide clear rules and create a minimal administrative burden on the private sector. I think everyone supports that. But the discretion to decide whether reporting poses significant harm to the individual is left to the organizations subject to PIPEDA, and that concerns me.

I know there are a number of big companies. We tend to think of the Internet giants, which have privacy protection officers, who are tasked with ensuring respect for people's privacy. The problem is that 98% of companies are small or medium-sized. How are you going to help them and support them? Will small and medium-sized businesses be given tools to guide them as they try to figure out whether a breach poses significant harm?

[Chris Padfield]

As we go through this, there are lots of things that have to be established through regulation. We're quite conscious of the fact that these data breach provisions apply, from the local dry cleaner down the street all the way up to a big bank or a telecommunications provider. We're looking for the most simplistic ways we can have in terms of reporting, in giving out clear guidance. We'll work with the Privacy Commissioner's office once the provisions are in place to come up with really clear, straightforward guidance for small companies. We are conscious of the fact that this does apply all the way from the mom-and-pop shop up to the major multinational corporations that are better prepared for these kinds of things.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Do I have any time left?

[The Chair, Conservative, David Sweet]

You have 20 seconds.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

[The Chair, Conservative, David Sweet]

So actually, there's going to be outreach. You're saying there will be some outreach in that regard.

[Chris Padfield]

To bring the data breach provisions into force we're going to have to pass regulations, so we'll need to consult on the regulations and go through that. Then after that's done it's the role of the Privacy Commissioner to help provide guidance to companies about how to comply in these areas.

[The Chair, Conservative, David Sweet]

Thank you.

Mr. Warawa for four minutes, please.

[Mark Warawa, Conservative, Langley, BC]

Thank you, Chair.

Under the data breach notifications, a business that's been hacked will be required to let their customers know that there has been this breach and they could be at risk. What's the timeframe they have to notify their customers? Who determines what is a reasonable length of time?

[Chris Padfield]

It's specified in the law as “as soon as feasible”. For us that means once you've closed the breach, you're not at risk by informing folks. If the breach is ongoing, by going around informing people it could be further exasperated, so once you've clearly identified the breach and you're able to contain it and move forward with it.

It's meant to be as soon as feasible, so without any undue delay. The exact time's not specified because each breach is different. There could be quite a few different elements.

In terms of determining that risk assessment, we haven't prescribed, and in general PIPEDA doesn't prescribe. It isn't very prescriptive in terms of providing these kinds of things. It provides a general sense.

[John Knubley]

I can maybe just add, though, that in terms of the offences that are under the act, there are three new ones related to data breach. There's a real demand for compliance in this respect. New offences are related to failing to report the data breach to the commissioner as required, failing to notify an individual of the data breach as required, and failing to maintain the records. These are actually offences now, so there is a lot of incentive for firms to do what is required as soon as possible.