Industry Committee on Feb. 17th, 2015

[Scott Smith]

To small business, probably less so. To large businesses, they will be significant, particularly as I mentioned the ones that are targeting large numbers of different classes of individuals.

[John Carmichael, Conservative, Don Valley West, ON]

Right.

Mr. Elder or Mr. Hill, do you want to comment?

[Wally Hill, Senior Vice President, Government and Consumer Affairs, Canadian Marketing Association]

Yes, thanks.

To reiterate in a little more detail, Scott is correct in highlighting that the law has been in effect for over a decade now. It's an ongoing process. Organizations are constantly upgrading their security procedures and practices, and their technology. All of us are reading about technological changes every day, and those pose new challenges for marketers and for businesses every time there is a significant development. Businesses need to stay on top of their game, and they work constantly to do so. They have been doing that on the basis of PIPEDA since the early 2000s.

In terms of small businesses, the only thing I would add is that there are elements of the law that present concerns to us. I missed the introductory remarks, but with regard to the record-keeping requirements, for example, there is some concern that if they're not qualified a bit more, that could pose a burden for businesses generally, but particularly small businesses, in terms of having to keep records relating to a breach.

[The Chair, Conservative, David Sweet]

We're over time and we have to stay pretty strict. There is another committee coming in afterwards.

Ms. Sgro, for four minutes.

[Judy Sgro, Liberal, York West, ON]

Thank you very much, Mr. Chair.

Welcome to our guests.

The whole intent is on how we better ensure through Bill S-4 that Canadians are protected and that the appropriate law enforcement and so on have the tools they need to do their jobs. I think that's what everybody wants to see happen. Whether Bill S-4 accomplishes that or not is fully questionable.

Mr. Smith, you mentioned the issue of network information security in particular . Would you elaborate a bit more on that?

[Scott Smith]

There are provisions under clause 7 that provide exceptions, for example, for protecting for fraud, and it was discussed in the previous session. There is no provision to manage a cybersecurity hack, for instance. An example is the Waledac. It was a botnet that attacked large numbers of computers, and it had the ability to send 1.5 billion spam e-mails a day. The only way to counteract that is to collect information from those computers that are hacked and then provide advice to those individuals on how to solve that problem. It has to happen in a fairly short period of time; you wouldn't have time to collect the consent to do that. For businesses to operate and share information and collect information in real time, they do need some kind of exception to operate.

[Judy Sgro, Liberal, York West, ON]

Does anybody else want to comment on that?

It gets very complicated and difficult. Government today has one intent here, and it's to make sure that people are protected. You looked at consent. You have seven-year-olds and probably even four-year-olds with iPads and they want to keep that gas going and they'll be hitting “I accept”. They don't read it; they don't care about it. They're just accepting it and they're fully exposed in having allowed that consent.

How do we better protect the consumer? That's what I want to make sure of. You've mentioned some amendments on other ways, but I think that consent issue is a really important one when you talk about new immigrants to Canada who are not completely familiar with the English language. People are accepting; we as parliamentarians are not reading the “I accept” thoroughly, and let's be honest about it. We're all busy; it's just going to be the normal stuff. We want to make sure we're making that safer and better so the consumer and Canadians are better protected.

You seem to be more concerned with the impact it's going to have financially on businesses, which I understand as well, but we want to be able to do both.

[Scott Smith]

If I could just go back to the cybersecurity issue for one moment, the whole intent of that requested amendment was to protect consumers and individuals. In other words, it's those consumers and individuals whose information is at risk, and we're just suggesting that to be able to handle that it's not in their best interest to ask for their consent in the first place. It's in their best interest to handle the problem.

[Wally Hill]

I would hearken back to the minister's comments a week or so back when he was talking about proposed section 6.1 being designed or intended to better protect the especially vulnerable groups, particularly vulnerable groups in society such as children, and I think that is an important objective of PIPEDA. Many experts believe that PIPEDA has built into it now the provisions that allow the Privacy Commissioner to specify the forms of consent that are needed in specific circumstances relating to children or adults.

I would also point out that a combination of best practices and self-regulatory regimes is out there in the marketplace, as well as PIPEDA, that helps to protect certain groups. Our own code of ethics embodies provisions specifically designed to protect children, especially those under 13.

[The Chair, Conservative, David Sweet]

Thank you, Mr. Hill.

We're over time again; I apologize that I have to intervene a second time. Somebody asked Mr. Hill a question up front and I didn't want to interrupt him again.

Mr. Daniel, you have four minutes.

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you, folks, for being here.

I was listening intently to all your discussions and there were a couple of terms that I didn't fully understand. Mr. Elder, you talked about overcollection. What is this overcollection? Why is it being collected, and what's the purpose of it?

[David Elder]

Thank you for the question.

The overcollection I was referring to was, I think, a likely outcome of proposed section 10.3 in the bill that requires organizations to “keep and maintain a record of every breach of security safeguards involving personal information under its control”. Personal information is a very broadly defined term. It's really any information about an identifiable individual and there can be frequent small breaches, technical breaches happening every day. I will give a couple of examples. Let's say a misprinted address label goes out in the mail that includes in the address window the party's age. That's a breach, a piece of personal information tied to an identifiable individual. Let's say you're in a store and the clerk leaves somebody's order printed out on the counter while he turns to get the phone and it's visible to other consumers and all that may have been disclosed was somebody's shoe size. That's a breach. A record would have to kept for each of them under this law and retained indefinitely until the OPC requested it.

I think that's our concern, that there's no threshold here of materiality and I think because of the concern that this provision is tied to an offence provision, there will be overcollection. Businesses will err on the side of caution and will record everything in all the stores and all the call centres everywhere across the country.

[Joe Daniel, Conservative, Don Valley East, ON]

That's your interpretation of the bill as it stands. That's kind of your definition as well, which brings me to my next question, which is about what was considered a minor breach. You're basically saying it's a breach that doesn't impact anybody. Is that what you're saying?

[David Elder]

Yes. I think we already have standards in this bill and in previous bills that could be helpful in terms of talking about, for example, we think it's certainly reasonable to keep records if it's reasonable that the breach would create a real risk of significant harm to an individual.That's already proposed for notification of individuals and the Privacy Commissioner. I think that would be a good standard in terms of materiality for the record keeping required. You'd know that they meant something and there was some real risk of harm.

[Joe Daniel, Conservative, Don Valley East, ON]

This question is for both organizations. Are you actually collecting data relating to the impact of some of the bigger breaches? We're not talking about these minor ones now. What is the financial impact on the organizations that have been breached? What are the financial implications to those whose information has been breached? Is there any tracking of that so we have some measure of what's going on?

[Scott Smith]

To answer that question, yes, that's part of any company's process in evaluating a breach: what is the impact of the breach? They all have internal policies on how to manage that. Financial institutions would have a very rigorous set of policies, whereas a small business may have something very straightforward, depending on the type of information they collect.

[The Chair, Conservative, David Sweet]

Thank you very much.

Now on to Ms. Papillon.

You have four minutes.

[Annick Papillon, NDP, Québec, QC]

Thank you, Mr. Chair.

Bill S-4 can force private sector organizations to report any losses or breaches of personal information. The test proposed for this mandatory reporting is subjective since it enables the organizations themselves to determine whether it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

In your view, can we ask organizations to determine themselves what constitutes significant harm? Would that assessment not be too subjective? What do you think about that?

[Wally Hill]

Individual organizations have a lot at stake in terms of ensuring that they properly weigh the impact of any breach on their customers. Their most important assets as business organizations are their customers, so making that sort of evaluation is one of the most important functions an organization has to take on when there is a breach situation. They are in the best position to evaluate the level of risk to their customers, and then to take appropriate action.

I believe that the law as drafted largely has that component constructed in an appropriate way. There is provision for reporting also to the Privacy Commissioner, which is an additional component that supports, I guess, the safeguards under the new provisions of the law.

[David Elder]

If I could add to that, I would say that the other thing working here is that in all cases, this is being overseen by the Office of the Privacy Commissioner. At first instance, a business may make the call as to whether something creates a significant risk of harm, but ultimately that will be up to the OPC to review at some point, or a court, and if organizations get it wrong, that's an offence under this act. They're subject to fines on summary conviction, so there's a lot of incentive there for them to get it right.

[Annick Papillon, NDP, Québec, QC]

The organizations don't necessarily agree on what a real risk of significant harm is. In your view, will the standard proposed lead to under-reporting or over-reporting of the breaches identified by those organizations?

[Wally Hill]

I would suggest that it will lead to an appropriate level of reporting, and reporting those breaches that should be reported both to the Privacy Commissioner, and most importantly, to affected consumers.

[David Elder]

I think, as we heard from the Privacy Commissioner himself this morning, the experience with the breach of reporting regime in Alberta and with the voluntary regime in the rest of Canada shows that companies are tending to over-report.

[Annick Papillon, NDP, Québec, QC]

Actually, we heard this morning that, in Alberta, the workload doubled overall. That will certainly affect the resources. It is a good reminder.

Clause 24 of Bill S-4 is amending section 28 of PIPEDA. It says that every organization that knowingly contravenes the new provisions of PIPEDA, which require organizations to report security breaches and to retain that information, or that obstructs the commissioner in the investigation of a complaint or in conducting an audit is guilty and liable to a fine not exceeding $100,000 for an indictable offence and not exceeding $10,000 for an offence punishable on summary conviction.

In your view, are there any indications that the risk of a fine of up to $100,000 could help enforce the law?

[The Chair, Conservative, David Sweet]

Sorry, Ms. Papillon. We went over during your question, so if somebody wants to answer it during another round, you can do that.

Mr. Warawa, for four minutes.