Information & Ethics committee  You would not be able, in Canada, to get a court order requiring a newspaper to unpublish something that was true. Our body of case law related to freedom of expression, defamation, and other things like that support that entirely. If you can't tell the newspaper not to publish it, not to make it available anymore, should you be able to tell an uninterested third-party search engine to not tell people that it exists?

Information & Ethics committee  I'm not sure I have a solution. I have the advantage of getting to stand on the sidelines and point out problems. To the extent that I can contribute to solutions, I'm happy to. The problem is always going to be a threshold one, and I think the problem needs to be addressed by the people who are publishing it, rather than intermediaries who are pointing out that it exists.

Information & Ethics committee  I think that one of the themes of my writing and thinking on this topic is that the location of the data is one factor, but it's not the overwhelming sine qua non of what the issue is. There are other factors that go into it. The Treasury Board policy related to this topic is in fact a really good and really rational approach to it, which is, if any government department is going to make any decision about the location of data in connection with outsourcing, or anything else like that, location is going to be a factor, but there are other things as well.

Information & Ethics committee  I would echo that. If Parliament puts that in the Privacy Act, it says that this is, in fact, an absolute priority. If it's left in a Treasury Board policy somewhere, it's at the whim of the government and it could be reversed. If you do not do a privacy impact assessment, and you're legally required to under under the act, you've broken the law, which is more than slightly different from just avoiding a policy, skipping a policy, or a procedural step.

Information & Ethics committee  I'm in agreement with Professor Geist on that. There are opportunities, particularly if somebody is enrolling in a program, that they don't have to, where it is in fact much more of a voluntary relationship. Mostly your relationship with the government is involuntary, but when it's voluntary, we need to be absolutely clear and transparent.

Information & Ethics committee  I was just going to say that there is a continuum. You can always find a second, third, fourth use for information that has been collected. I do think that there needs to be reasonableness put in there, but having transparency about what government is doing, how they are doing it, and for what purpose allows Canadians to actually understand what is happening and to question it if it's problematic.

Information & Ethics committee  One of the wonderful things about Canadian laws generally is that they are usually technologically neutral. You don't focus on a technology. Certainly, technological changes can necessitate a kind of revisiting and updating, which obviously is the case here with the Privacy Act, but I think what has driven the need to update the Privacy Act actually isn't technology.

Information & Ethics committee  I would generally agree with that, although I would add that I think there's a difference between the Privacy Act and the Access to Information Act in this. One can understand that you have cabinet confidences and things like that, but there shouldn't be a system that would allow an office within the functioning of government to collect information and use it in a way that otherwise would be completely unlawful.

Information & Ethics committee  My initial thought is that there is a distinction between going to court to force government to do what it legally is supposed to do and preventing it from doing what it legally is not supposed to do: kind of your classic judicial review, or the implementation of an order to do or not to do something.

Information & Ethics committee  I would be careful about doing that. Other privacy statutes, in the rest of Canada, have provisions that allow individuals to seek damages after it has gone through the Privacy Commissioner process. The courts have generally said that this doesn't actually close the door on the other avenues, but you want to be very careful that it doesn't.

Information & Ethics committee  I would think that a general statement of principle related to that would have a natural home in the Privacy Act, to say that any formal or informal information-sharing arrangements between a government institution and another government institution or another government.... Federal-provincial information sharing takes place all the time, as it does internationally between CRA and the IRS in the United States.

Information & Ethics committee  Certainly. The Access to Information Act mandates transparency, but it has exceptions for unreasonable invasions of privacy, and it has some clarification language about what the thresholds are. Of course, it uses the same definition of “personal information” as in the Privacy Act.

Information & Ethics committee  In the amendments put into the private sector law, PIPEDA, by the Digital Privacy Act, there is a threshold that represents a real risk of significant harm. Part of that is a statement of principles, but if the information is encrypted and nobody can get access to it reasonably, that significantly lowers the risk of significant harm, so it might not even trigger the notification threshold.

Information & Ethics committee  Certainly. Not having any teeth in the legislation I think is ultimately problematic. Forcing the individual concerned to be the one who goes to court and has the onus of proving to the judge that somehow their rights have been infringed I think places too much of a burden on the individual.

Information & Ethics committee  I'm happy to provide my thoughts on that. The Privacy Act is well placed to consider metadata as a concept. The definition of personal information in the statute, if it's fixed in order to deal with the recorded or not recorded thing, is information about an individual. Metadata is information about an individual whether you're talking about metadata or the actual content, that's all information about an identifiable individual and it's all personal information.