Information & Ethics committee  That's why I mentioned earlier, Madame Lavallée, the idea of data-sharing agreements. They will say not only what personal information is being exchanged between Quebec, Ontario, and the federal government, but how it's happening and what the transfer mechanism is. That would really be part of reasonable security.

Information & Ethics committee  It might surprise you, given some of the positions I've taken, that I'm a great fan of research and public health surveillance, and big research projects. I have some wonderful clients at UBC who are doing wonderful work in child care, child protection, and things like that, the monitoring of children's health and vision and hearing over time.

Information & Ethics committee  I think Health Canada's privacy champion is at the ADM level. The only reason they didn't make him or her the chief privacy officer was because there was no tradition of doing it. I think the Canada Millennium Scholarship Foundation here and the federal government have a chief privacy officer.

Information & Ethics committee  I was shocked to learn the other day that there are now 13 federal officials--the ombudsman, Auditor General, and stuff like that. The reason I was shocked was this: imagine the risks, the increasing risks, of putting weak people or ineffective people in those jobs. That's the kind of concern I have about these high-level positions.

Information & Ethics committee  Richard Posner, the famous U.S. judge and economics professor, has a book on the economics of privacy. We argue, rhetorically, that privacy is good for business, that privacy is good business, that when you go to Costco or anyplace else and they tell you up front what they're going to do with your personal information and then they do it....

Information & Ethics committee  I don't like making public policy by anecdotes, but the Institute for the Study of Privacy Issues, which I subscribe to, every day sends me 30 to 50 English-language newspaper clippings from around the world and all over Canada about privacy breaches of the day. What I'd like to do is get your e-mail address and send you one a day for a while.

Information & Ethics committee  The biggest privacy disaster in the public sector in English-speaking countries in the last several months was in November or December. Tapes were lost in the United Kingdom, moving by courier from one government department to another, with information on something like 25 million people.

Information & Ethics committee  That's great, by the way.

Information & Ethics committee  I can't believe it. It's as if you're living in a 25-year-old house that hasn't been redecorated, and I'm the designer coming in to help you. And you say where should I start? Should I do the furnace first? Should I put a new roof on it? Do I do this, that, and the other thing. I'm not trying to be too facetious.

Information & Ethics committee  The problem I have is that a lot of the privacy breaches I'm aware of I have knowledge of under confidentiality agreements with my clients. I can't come and whistle-blow on my clients, but let me assure you, there are far more breaches taking place, which are far more sensitive in nature than you even read about in the newspaper.

Information & Ethics committee  There are some reasons, which I'm not going to go into in public, why I've been doing less federal work the last couple of years than I did from 1991 to 2003 or 2004. The best examples I can use are from the provinces and territories. You should be aware that Manitoba announced last week that it was finally going to set up a proper privacy commissioner and, to the best of my understanding, take the power away from the ombudsman, who had too many other things to do, and give the Privacy Commissioner of Manitoba regulatory power.

Information & Ethics committee  I'm a typical academic in the sense that I'm not very good at answering resourcing questions. It would not be a trivial cost but I don't think it would be major. I think everybody working for a government or a private sector has to work more efficiently, has to work smarter, has to focus on what ought to be done.

Information & Ethics committee  I was using those specific questions to establish if he had any sense of privacy, which we quickly established he does, as most of us do. Regarding the federal government, I describe agencies and departments as privacy-intensive if they collect a great deal of personal information.

Information & Ethics committee  With all due respect, I'm not sure that's indeed the case, and I say that from the basis of my consulting work. In my paper, which I'll be sharing with the committee shortly, once it's translated, I use Health Canada, as I explained earlier, as a pretty good model, and I think I had something to do with stimulating them to put privacy risk management strategies in place.

Information & Ethics committee  I'm going to use a provincial example, because the report came out yesterday. New Brunswick was shipping personal information on 750 people from B.C. who had been treated, I guess, in New Brunswick. British Columbia was going to pay the Ministry of Health. The Ministry of Health was shipping data on tapes from New Brunswick's Ministry of Health to British Columbia, to Victoria.