Bill C-475 (Historical)

An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power)

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things, give the Privacy Commissioner the power to make compliance orders and the Federal Court the power to impose fines in cases of non-compliance.

Digital Privacy Act

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would remind the House that we are debating a motion to refer Bill S-4 to committee before it passes second reading.

The member who just spoke talked about all the good aspects of Bill S-4, and yet he voted against my Bill C-475, which proposed more or less the same things, if not better protections for Canadians.

However, my question is more about the Supreme Court decision regarding a provision of this bill related to personal data. We do not know whether the Conservatives plan to change this provision during the study in committee.

Is the member who just spoke afraid that this bill will be considered unconstitutional? If not, why does he not want to consider the Supreme Court's decision in the Spencer case in relation to this bill?

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I am happy to rise in the House today to speak to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act. As members know, today's debate turns not precisely on Bill S-4 but on a motion to refer the bill to committee before second reading.

The concerns that I will raise with respect to the bill itself, which go as far as to challenge the constitutionality of the bill, would likely be fatal to the bill at second reading, but we need not concern ourselves with that today. We need not arrive at a conclusion about how fatal these flaws are or how injurious they are to the bill.

The motion before us today would allow us to visit the scope and principle of the bill at committee and make, as required, amendments to those very principles and scope of the bill.

Today, I would argue that this motion warrants support, so that we have the flexibility to properly study, examine and propose amendments to the bill at committee before the principle and scope are set.

Let me set out a few reasons why this is particularly important in these circumstances and relating to this particular legislation.

First, let me address the issue of public opinion that sets the context in which this bill and more broadly the issue of privacy concerns exist.

According to a survey of Canadians on issues related to privacy protection conducted last year, 70% of Canadians feel less protected than they did 10 years ago; only 13% of Canadians believe that companies take their privacy seriously; 97% of Canadians say they would like organizations to let them know when breaches of personal information actually occur; 80% of Canadians say they would like the stiffest possible penalties to protect their personal information; and 91% of Canadian respondents were very or extremely concerned about the protection of privacy.

The current government cannot absolve itself from contributing to this level of public concern about privacy issues. It is not just a matter of legislative lethargy; that is, it is not just about the fact that we are well past the five year mark for the conduct of a mandatory review of the Personal Information Protection and Electronic Documents Act, an act that is by now well behind international standards and has failed to keep up with technological advancements in this digital age.

Part of the issue here is that the current government has itself repeatedly demonstrated insufficient care for the personal privacy of Canadians through its own conduct. I would point to the fact that in one year alone, under the current Prime Minister's watch, government agencies secretly made more than 1.2 million requests to telecommunications companies for personal information, without warrant or proper oversight.

It is a government with a seemingly insatiable appetite and perhaps an addiction to Canadians' personal information. It is a government that needs to be constrained by effective legislation that protects the privacy and personal information of Canadians. It is a government that has no credibility on this subject matter.

This is evident in the legislation that the Conservatives have defeated in this House. In 2012, our NDP digital issues critic, my colleague from Terrebonne—Blainville, put forward Bill C-475, a bill to amend the Personal Information Protection and Electronic Documents Act. It would have applied similar online data protection standards that exist in Quebec's personal information protection act. For example, Bill C-475 would have given the Office of the Privacy Commissioner of Canada the power to issue orders following an investigation. The Conservatives defeated that bill at second reading. They also defeated our NDP opposition day motion on May 5 last year. That motion simply called on the government to close loopholes in existing legislation that currently allowed the sharing of personal information without warrant.

The current government's disregard for private and personal information is also evident by the legislation that it has brought forward.

Bill C-13, the government's cyberbullying law, includes lawful access provisions that would expand warrantless disclosure of information to law enforcement by giving immunity from any liability for companies that hold the information of Canadians to disclose it without a warrant. This makes it more likely that companies would hand over information without a warrant as there are no risks that they would face criminal or civil penalties for such conduct.

There is a thread here that runs through the government's own efforts to access the personal and private information of Canadians through to their conduct and voting record in this place. It goes against the interests and concerns of Canadians and denies the wishes of Canadians for greater protection of their personal and private information.

In other words, the issue before us goes to the principles underlying this bill. They need to be examined and amended at committee. For example, while Bill S-4 would make it mandatory to declare the loss or breach of personal information for the organizations in the private sector and penalize organizations that do not fulfill this obligation, the proposed criteria for mandatory disclosure remains subjective. It would allow the organizations themselves to assess whether “it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”.

More and most problematically still, Bill S-4 would add exceptions under which personal information may be collected, used or disclosed without an individual's consent. The bill would make it easier for organizations to share personal information with each other without the consent of individuals if the organizations are engaged in a process leading to a “prospective” business transaction. In other words, under certain circumstances, the bill allows personal information of one organization's clients to be shared with another organization without the consent or knowledge of those individuals.

Here we run into some significant problems with this bill. The amendments proposed contradict the very foundation of the act they seek to amend and serve to defeat what the Supreme Court called in R. v. Spencer the act's “general prohibition on the disclosure of personal information without consent”. As the Supreme Court said in that recent decision, “PIPEDA is a statute whose purpose is to increase the protection of personal information”.

The Supreme Court, in R. v. Spencer, got to the heart of the issue here, understanding what the government has failed to understand about the issue of informational privacy in the digital age. It is worth quoting at length here. It stated:

Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.

So, from subscriber information, the Supreme Court has connected that information through to search and seizure.

We have at least before us a major concern with the principles of this act, but seemingly too a bill that is simply unconstitutional. Leaving aside for the moment this latter issue, let me suggest by way of conclusion that if there is something in Bill S-4 that is salvageable, it can only be so if this bill moves to committee before this House sets in concrete the principles and scope of this bill, and limits the kinds of amendments that can arise out of committee post second reading.

[Dan Harris, NDP, Scarborough Southwest, ON]

Mr. Speaker, I will begin by refuting the claim by the member regarding New Democrats secretly harbouring these strange desires to become senators. For the entire 50-year history of the New Democratic Party, we have called for abolishment of the Senate.

We believe in Canadian society and we do not need to have a House for people who consider themselves above the rest of us, which is often what has happened. Certainly there are currently cases before the courts regarding Mike Duffy, Pamela Wallin, Patrick Brazeau, and Mac Harb. This is certainly not a group that any New Democrat wants to become a part of. It flies in the face of democracy.

As my colleague for Nickel Belt pointed out, if the bill is so important, why is it coming from the Senate rather than the government?

The Conservatives have formed government for nearly eight years now, and they are finally getting to this matter. Hacking is not new. Invasion of privacy is not new. Why were these changes not brought before us years ago?

I would also like to address the fact that the bill is being referred to committee before second reading. I actually applaud the government for this move, but my next question is to ask why this did not happen before. Why was this approach not taken regarding electoral reform? Why was this approach not taken regarding some first nations' issues that have come before the House so that we would have a broader scope of study within committee and an attempt at working together?

When the parliamentary secretary first rose to speak on the bill, he said that bringing the bill to committee before second reading would help to ensure that the best bill would be brought forward. I think it demonstrates that perhaps the current government is not always interested in bringing the best bill forward, because we are three years in, and this is the first time that the Conservatives have chosen this approach.

We have had numerous instances of bills being brought forward by the government and then being overturned by the Supreme Court of Canada. We potentially could have prevented that from happening had we taken this approach with other bills or had the government listened to opposition amendments and suggestions to make sure that the bills conformed with the law.

Traditionally, of course, adoption at second reading amounts to approval of the principle of the bill by the House. This can often restrict the committee's ability to make changes and amendments, which is something we would avoid with this bill. I hope that the industry committee takes the proper amount of time to study this issue before referring it back to the House. I certainly think the capacity is within the industry committee to do so. We have an opportunity to fix the parts of the bill before us that are lacking.

With regard to the rationale given by the member across the way for some intrusions into privacy, it is not so cut and dried. It is not a black-and-white issue. These are issues that need to be explored further, and the committee setting is the appropriate place to do that. The question is, will that in fact happen?

Most of us are surprised and a little confused as to why the government is taking this approach. The Conservatives have had many opportunities to use this approach in the past, but have never chosen to. It will be very interesting to follow the proceedings in the industry committee to see where this goes. Is it because government members want to make substantive changes that their brethren in the Senate missed, avoided, or did not put in?

Perhaps that is why the Conservatives are bringing it forward, but only time will tell. One of the very important lessons I have learned here is not to believe it until it happens, which can be said of so many different things we do in the House. There are a lot of rumours out there, but it would be good to try to stick to fact as much as possible.

Since the committee will have the opportunity to properly consider and make necessary changes to the bill, we are supporting the motion to send the bill back to committee. I think it makes a lot of sense, and it is an approach that should be used more often.

That this was done without a warrant raises questions. I would hate for court cases to be moving forward in which evidence might be thrown out because warrants were not obtained. The result would be an increased cost for the judicial procedure, and there is the potential as well for letting some criminals off the hook when they should be facing prosecution. We definitely need to beef up those aspects.

There is a provision within the bill that would make it easier for companies to share personal information without warrant or consent from clients and with no proper oversight mechanisms in place. Following a recent decision from the Supreme Court of Canada, this provision will most likely be considered unconstitutional.

The government must respect the Supreme Court ruling by withdrawing all clauses relating to warrantless disclosure of personal information from the bill. That is a very reasonable position. Canadians would expect that if law enforcement agencies are seeking people's personal information, they would have to follow a process, and obtaining warrants is a very important part of our system. It has to be proven that the information is needed before a warrant is obtained. That is a minimum standard when seeking this information. Currently, with these warrantless provisions, requests can be made without any oversight. That is troubling to many Canadians who are concerned about their privacy.

We are also concerned about many of the negative consequences that certain provisions in this bill might provide.

It is also interesting to note that the bill was largely inspired by Bill C-475, which was tabled in 2012 by my colleague, the member for Terrebonne—Blainville. Rather than wasting time and avoiding creating better protections for Canadians, the Conservatives should have simply supported the NDP's bill, which would have done more to protect Canadians' privacy.

Privacy has been a thorny, low-priority issue for the Conservatives, who have been incapable of adequately protecting Canadians' privacy. Their own departments have been responsible for allowing thousands of breaches of personal information while citing privacy considerations and decrying heavy-handed government.

The Minister of Industry argued that the long form census was intrusive to Canadians' privacy, and it was eliminated. However, the government sees nothing wrong with invading Canadians' private information without a warrant and without telling them. It is bizarre that these things would be happening and that nobody knows about them until it is too late.

Now I look forward to questions from colleagues.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, in the digital age, there are many new risks. I offer a computer security course for seniors at a seniors centre in my riding. This helps me to see just how concerned people are about the risks they face in the digital age. These individuals do not necessarily know what happens when they enter their personal information into the vortex of Facebook, Google or any other network. People often think about the two examples that I just mentioned, but this goes even further than that. Phishing emails are often sent to people who do not necessarily know how to distinguish between a phishing email and a legitimate email.

I want to share some key figures that show just how concerned people are about this issue. A total of 70% of Canadians feel less protected than they did 10 years ago, 97% of Canadians would like organizations to inform them in the event of a data breach, and 91% of Canadians say that they are concerned or extremely concerned about the protection of personal information. That is huge.

The NDP has taken action on this file. We introduced Bill C-475. On one opposition day, we moved a motion to close the gaps in the Personal Information Protection and Electronic Documents Act and to enhance the transparency of the parallel system for information sharing between Internet service providers and government agencies. We took action. Unfortunately, the government took an extremely long time to propose amendments to the Personal Information Protection and Electronic Documents Act and debate them. We are happy to be doing this today. Unfortunately, this is not an ideal bill. It needs to be improved.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, the motion we are looking at today is unique in that it is the first of its kind in Parliament.

We have to wonder whether it is worth sending this bill to committee before it is passed at second reading, since that is not in keeping with the usual legislative process. While I have numerous concerns about Bill S-4, I still plan on supporting today's motion because I think that we can work together to improve the bill. However, that does not mean that I support the bill, and I must make that distinction.

As parliamentarians, we have been elected to work together and find effective solutions. That is what I am hoping to do today. I want to reach out to the government in the hopes of improving this bill because some of the elements are a step in the right direction.

As the hon. member for Chicoutimi—Le Fjord said, I introduced Bill C-475 in the House. That bill was designed to make significant changes to the Personal Information Protection and Electronic Documents Act, PIPEDA, to ensure it reflected the reality of the digital era. Unfortunately, the Conservatives voted against it. There could have been better protections in place, but we were unable to work together. This time around, I hope that will be possible.

It is extremely important that PIPEDA be updated, since it has not been updated since the very first iPod was introduced. Technology has evolved. Facebook did not even exist yet at the time. Things have really changed, and the law must reflect the current reality. This bill is a good first step, but it does not go far enough.

For instance, it is important to introduce a mandatory system for notifying users of data losses and data breaches. However, the model proposed by the government is subjective: organizations can decide whether the data breach is significant enough to report. In some situations, these organizations will not have the best means or knowledge to do this, especially the really small organizations. Is it really in their interest to disclose such data breaches? Probably not.

Bill C-475 proposed a model that was objective. That is one aspect that must absolutely be improved in order to better protect Canadians' privacy, and I hope this change can be made in committee.

It is important to implement a system that will ensure greater compliance with PIPEDA. With international digital mega-corporations in the picture, our laws are too frequently broken because there are currently no penalties. That is why we need a system of penalties to enforce corporate compliance with PIPEDA and Canadian privacy laws.

Unfortunately, Bill S-4 does not go far enough in this respect. It creates the option of putting together a committee that will act in good faith. Sometimes everyone acts in good faith and is happy, but that is not always how things work.

The commissioner has to be able to issue orders earlier in the process, but that is not what the government has proposed. That is what I proposed in Bill C-475, and that is another change that will have to be made to Bill S-4 before we can support it.

However, what really bothers me about this bill is the provision that would allow organizations to share personal information without a warrant and without the consent of the individual concerned. That is a huge problem. Even though this bill is called the digital privacy act, it contains a provision that could really interfere with the protection of privacy. I find that deeply contradictory.

It is also extremely important to point out that between the time that this bill was drafted and the debate today, the Supreme Court reiterated in its ruling that information such as data from Internet service providers on their clients, including their IP addresses, email addresses, names, telephone numbers, and so forth, are personal information and cannot be obtained without a warrant. Obviously, I am paraphrasing, but that is more or less what the Supreme Court ruled.

I have major reservations about the constitutionality of this provision of the bill. I asked the government to reassess it and withdraw it. Unfortunately, my request was not favourably received.

I think we could work together during review in committee on withdrawing this provision, which may violate the Canadian Constitution. I hope that is why the Conservatives want to send this bill to committee.

Obviously this is a Senate bill. During review in committee, a number of witnesses shared their concerns over this very provision. The Privacy Commissioner said the following in a brief:

Allowing such disclosures to prevent potential fraud [as provided for in clauses 7(3)(a.1) and 7(3)(a.2)] may open the door to widespread disclosures and routine sharing of personal information among organizations on the grounds that this information might be useful to prevent future fraud.

Indeed, the government wants to protect personal information, but allowing access to that information without a warrant, without consent, without any judicial oversight and without transparency is very problematic.

On many occasions, the government has used PIPEDA and its loopholes to call on Internet service providers and ask for Canadians' personal information. Why? We do not know. We do not even know exactly how many requests have been made, because this information is not available to the public. However, based on what the Privacy Commissioner revealed, we know that in a single year, government agencies made at least 1.2 million requests to Internet service providers to obtain personal information about their customers. That is a huge problem.

The government could have taken this opportunity to truly protect Canadians' privacy and to fix the loopholes in PIPEDA that allow this kind of information to be transmitted without legal oversight, without consent and without any transparency. It could have done that. I hope it will do so during the study in committee. That is very important. I am just making a suggestion.

We are debating the motion today. We are prepared to agree to study this bill before it passes at second reading, as is usually the case. I hope that this will be a gesture of good faith, and that the Conservatives will take this opportunity to fix the loopholes in PIPEDA and to eliminate the clause allowing organizations to share information without a warrant. We cannot support a bill that contains provisions that violate Canadians' privacy.

[Dany Morin, NDP, Chicoutimi—Le Fjord, QC]

Mr. Speaker, I thank the two previous speakers.

My colleague from Terrebonne—Blainville had some good questions for the parliamentary secretary. She even introduced Bill C-475, which proposed a number of provisions that can be found in Bill S-4.

Why did the Conservatives not vote in favour of the bill introduced by my colleague from Terrebonne—Blainville, even though several of the provisions in her bill are in Bill S-4, which they want to pass?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

That's precisely what I had proposed in Bill C-475, which I introduced and the Conservatives voted against. It's really too bad. We will keep trying to get similar measures passed.

Do I have any time left, Mr. Chair?

[Dr. Éloïse Gratton, Partner and Co-Chair, Privacy, McMillan LLP, As an Individual]

I will start. Thank you for the invitation.

I'll give the first part of my presentation in French and the second, in English.

I'd like to start by discussing the legal framework governing privacy protection and the response of business. Despite the legislation that exists, the Personal Information Protection and Electronic Documents Act, or PIPEDA, companies and organizations have no real incentive to comply with the act and implement appropriate security measures. What's the worst that could happen from a company's perspective? What are the risks if they don't comply with the act? Not much. The worst case scenario is that their reputation might be tarnished. For example, if a complaint is made, and at the end of the investigation, the commissioner decides to release the company's name, then obviously, the company's reputation might be sullied. That very seldom happens, though.

There is another potential risk. When an individual is notified by the commissioner that the act was in fact breached, that person can take the company to Federal Court for damages. The court has made a few such rulings in the past decade. In five to ten cases, the Federal Court awarded small amounts. In some cases, it awarded no damages, and in others, $5,000.

Last fall, in its ruling on Chitrakar v. Bell TV, the Federal Court awarded $20,000 in damages, and that was a first. Is this the beginning of a new trend? Perhaps. Only time will tell. One thing is for sure: not everyone has the means to take legal action against a company to obtain small amounts in damages. In privacy violation cases, the amounts often range between $5,000 and $10,000. Engaging in a court battle is a complicated and painstaking process.

Furthermore, at the federal level, no incentives exist with respect to class action lawsuits over privacy violations, which have the potential to improve compliance. Incentives do exist in other jurisdictions. And in many cases, companies comply with privacy legislation as a result. Just think of the recent security breaches. Last January, a security breach occurred at Human Resources and Skills Development Canada. In April, a security breach occurred at the Investment Industry Regulatory Organization of Canada, or IIROC. And class action suits were launched in relation to both of those breaches.

In the case of IIROC, a portable drive containing the financial information of 52,000 brokerage firm clients was lost. The damages sought were $1,000 per individual. That has the potential to motivate companies to comply, but under PIPEDA, that isn't an option. The legislation contains no such provision to motivate companies. And even if it did, a class action lawsuit isn't necessarily appealing because authorization to proceed isn't always granted.

In the Quebec case of Larose c. Banque Nationale du Canada, the Superior Court made a ruling in 2010. A typical breach, it involved a lost laptop containing the financial information of many clients. One of the clients was not very happy and took the National Bank to court. At the authorization stage, counsel for the complainant had to show that, as a result of the security breach on the bank's part, actual identity theft had occurred. The court stipulated that the fear of identity theft alone did not entitle someone to compensation. Had there been no evidence of actual identity theft, the court would not have granted authorization for a class action.

That tells you just how high the bar has been set. Proceedings of this nature are not straightforward. And the damages aren't very high. So what's left? If you can't seek compensation because you're afraid you were the victim of identity theft as a result of a security breach, there is little else you can do.

Let's come back to the legislation concerning security measures. Companies are advised to adopt security measures based on the level of sensitivity of the information. Even when companies contract out services to a third party, the legislation says they are still responsible for the information and must ensure its protection through the contract. In reality, what we often see is companies using cloud services or third-party contracts. They contract the service out and then turn a blind eye to what goes on.

I would like you to consider a provision in a piece of Quebec legislation that I see as very useful. It imposes an additional obligation on companies preparing to give or transfer personal information to a third party via a contract. I am referring to section 26 of An Act to Establish a Legal Framework for Information Technology. It reads as follows:

Anyone who places a technology-based document in the custody of a service provider is required to inform the service provider beforehand as to the privacy protection required by the document according to the confidentiality of the information it contains, and as to the persons who are authorized to access the document.

The person who entrusts the function to a service provider and transfers the data to the provider, whether via cloud computing or some other means, has an obligation to tell the service provider how to protect the information in question. I think incorporating a similar provision in our legislation could be useful.

I am active in the protection of privacy and personal information. There is a prevention component to my work. That entails advisory services, compliance, training, policy development and so forth. I am also involved in crisis management. I help with the management of security breaches, provide assistance when complaints are made to privacy commissioners in various jurisdictions and give advice related to privacy class action lawsuits. Clients rarely ask me to do any prevention work for them unless they have had some sort of crisis first. That shows that companies aren't very tuned in to the issue. And yet, the legislation exists. Are they motivated to comply with the act? Not especially, because they wait until a security breach has occurred before taking action. Not until a crisis arises do they realize how costly it can be and that they might do well to invest in prevention.

It's also interesting to see just how many resources are being deployed to compliance and prevention around the coming into force of Canada's new anti-spam legislation. That piece of legislation is being taken seriously. It includes liability provisions that apply to administrators, executives and employers. And since the penalties it sets out are quite stiff, companies take it seriously. Ever since its coming into force was announced, the legislation has monopolized my practice almost full time. Is spam a bigger problem or greater evil than security breaches or identity theft? I doubt it. Why, then, is the situation the way it is? What are we waiting for to motivate companies to invest in prevention?

I have one last point. My second part will be very short.

Some studies show that most security breaches are the result of human error. I am referring to two studies, in particular, that were conducted two years after the requirement to report a security breach was imposed on companies. The first was done by Alberta in 2012-13 and lists all the notifications and security breaches. According to that report, human error was at fault in many of the cases. The second study was done by the Ponemon Institute in 2013 and says that in 33% of cases, employee error was to blame.

That, too, shows that companies aren't taking employee training around privacy protection seriously. Very often, the security breach resulted from a laptop being left in a car. Was the employee aware that behaviour posed a risk? Was a relevant policy in place? Was appropriate training available? The jury is out.

I know time is running. The second part is going to be quick.

I want to raise the fact that currently under PIPEDA we don't have mandatory breach notification, and I believe that this may well play an important role in addressing some of the financial harm that may be triggered in the case of identity theft following a security breach.

If individuals, whether they be consumers, employees, are notified, it will help them to better protect themselves against harm, such as identity theft, because once they're notified they're going to pay special attention to their financial statements every month, every day, tracking down any suspicious or unauthorized transactions. They're going to monitor their credit through credit-rating agencies, such as Equifax and TransUnion. It will also provide businesses with an incentive to establish better data security practices in the first place.

What's the status on mandatory breach notification outside of Canada? We have it in Europe and in the United States. Most of the states in the U.S. have breach notification laws. In Canada, Alberta so far is the only private sector jurisdiction that has this law, and they prescribe fines up to $100,000 for businesses. They have realized that this breach notification obligation in their law has increased the reporting of security breaches, and it has also increased the privacy training. Businesses are more inclined and are more motivated to spend, because they realize that it's going to be an obligation to disclose the breach if there is such a breach.

In Quebec there is a consensus that it is needed. In 2011, la Commission d'accès à l'information du Québec published a report in which they said that this is needed. It's a matter of time. It's in the hands right now of the legislature, but we will have also this obligation in Quebec shortly, hopefully.

At the federal level, we've had various bills that have been introduced: Bill C-29, BillC-12, Bill S-4 recently, and Bill C-475. The latest one is Bill S-4. Will Bill S-4 do the job if it becomes law? It's better than having nothing, that's for sure. Maybe it's not perfect, but it's better than having nothing.

I guess it would create the incentive for businesses to disclose, and I think we need to trigger that incentive. In an ideal situation there should be clear monetary penalties for not reporting security breaches to individuals and to the privacy commissioners. There should be a duty to report a breach as soon as possible. I'm cautious with providing fixed delays, because I've been on the other side. Sometimes there's a breach and you need to do the investigation before you start notifying individuals and privacy commissioners, because you need to know exactly what happened and what needs to be told or not told.

The Privacy Commissioner, I believe, should be given the power to order an organization to report a breach to customers. These orders should be made public and the organization should be named. I think that would create the necessary incentive for them to invest in preventive measures, which would be beneficial to address a financial harm resulting form identity theft.

This is my last point. It would not be a bad idea to have a uniform breach notification law in Canada. Various systems could become problematic when there's a breach. I know that a few years ago, the Uniform Law Conference of Canada drafted a breach notification act. Maybe it could be used as a tool.

Thank you. I think my time is up.

[Mathieu Ravignat, NDP, Pontiac, QC]

Thank you, Madam Vice-Chair.

My thanks to the witnesses for joining us today. Good morning; it is nice to have you with us.

I do not know if you are aware, but my party, the NDP, has introduced Bill C-475 and Bill C-580, which are designed to strengthen the legislation that deals with the privacy of Canadians. The bills offer a solution to the fact that, legally, Canada is significantly behind the times in this digital age.

My question is more general in nature.

As a national police force, the RCMP has as part of its mission to ensure that the law is obeyed. Do you believe that Canada is adequately equipped at present to combat identity theft? Is the legal framework tough enough to help you in your work?

Opposition Motion--Communications Security Establishment Canada

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would like to thank my Liberal colleague for his speech, and especially for his comments regarding the minister's response. Many questions were asked by the NDP and the Liberals in question period and he always answered that Canadians were not targeted.

I do not know to what extent MPs understand how the collection of metadata works. Metadata about 100 million people in one room can be collected without targeting anyone. However, information has been collected that could reveal many things about a particular person.

The answer given leads us to believe that the government is not very concerned about protecting Canadians' privacy. We have seen that on a number of occasions. For example, the Conservatives voted against my Bill C-475 on personal information protection. Furthermore, they have failed to put in place transparency mechanisms for CSEC.

Consequently, what are the risks of casting a large net to collect metadata about so many Canadians? What risks does this pose to Canadians' privacy?

Opposition Motion—Communications Security Establishment Canada

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, I thank my colleague from Ottawa—Vanier for his question.

He touched on a very important aspect of today's debate, which is the right to privacy and the fact that the Conservative government is dragging its feet in this debate and has not proposed anything meaningful for years.

As I mentioned, my colleague from Terrebonne—Blainville introduced Bill C-475 on privacy protection. I know that my colleague opposite voted in favour of this bill, which proposed greater structure and some privacy safeguards.

We on this side of the House have noticed a flagrant lack of privacy regulations, and the fundamental rights of freedom and national security are being violated.

I find it sad to see that the Conservatives on the other side of the House do not want to create all-party structures and that they are trying to shut down the debate on the right to privacy.

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, I am pleased to rise today to speak to the motion moved by the second opposition party. The motion reads as follows:

That the House express its deep concern over reports that Communications Security Establishment Canada (CSEC) has been actively and illegally monitoring Canadians and call on the government to immediately order CSEC to cease all such activities and increase proper oversight of CSEC, through the establishment of a National Security Committee of Parliamentarians as laid out in Bill C-551, An Act to establish the National Security Committee of Parliamentarians.

How did we come to the point where we are debating such a motion in the House? It all started on June 10, 2013, when the previous minister of national defence approved a CSEC program to monitor the telephone and Internet activities of Canadians by collecting metadata. The program was first created by the Liberals in 2005, but was later suspended because of the concerns raised by the organization responsible for overseeing CSEC.

The minister at the time denied that statement. The law is very clear in that regard: CSEC does not have the right to spy on Canadians. The legislation that sets out its mandate explicitly states that its activities:

273.64(2)(a) shall not be directed at Canadians or any person in Canada; and

(b) shall be subject to measures to protect the privacy...in the use and retention of intercepted information.

There is only one exception to that provision. If the Minister of National Defence authorizes it, CSEC can get around that provision, which happened 78 times between 2002 and 2012.

In June 2013, the minister said that he had authorized nothing of the sort. However, in August 2013, Justice Robert Décary indicated in his annual report that Canadians had been the target of some spying activities. Unfortunately, the saga does not end there. In the months that followed, numerous documents revealed that CSEC had been spying illegally on Canadians. The latest revelations are probably the most troubling. On January 30, 2014, CBC uncovered information indicating that CSEC was able to track the movements of passengers at Canadian airports who used the free Wi-Fi networks on their mobile devices, including phones, tablets and computers. Not only did CSEC track them in the airport, but it continued spying on their devices for several weeks.

Those kinds of discoveries about CSEC's actions are alarming. What happened to abiding by the law and upholding the public trust in our intelligence systems? What happens when the system is broken and the public becomes distrustful?

That is why the NDP will be supporting today's motion. We need to take action before this problem gets even worse. However, I must point out that there are some significant flaws in this motion, particularly in relation to some of the provisions in Bill C-551.

Bill C-551 proposes to establish a committee made up of members of the House of Commons and senators who would be mandated to review national security activities of federal government departments and agencies. First, this committee would report to the Prime Minister, and he would be entitled to hide information from Parliament. It is crucial that the Prime Minister not be able to conceal national security information from parliamentarians under Bill C-551.

Second, this bill would give unelected senators a seat on the review committee. Honestly, I am not entirely sure where the Liberals stand, with their Liberal senators who are sitting outside of the caucus, or their independent Liberal senators, or their Liberal sympathizers who happen, by sheer coincidence, to be senators. It is all rather confusing. The NDP feels that only individuals duly elected by Canadians should be part of the committee.

That is why, last October, my colleague from St. John's East moved a motion to that effect. The motion reads as follows:

That (a) a special committee on security and intelligence oversight be appointed to study and make recommendations with respect to the appropriate method of parliamentary oversight of Canadian government policies, regulations, and activities in the area of intelligence, including those of all departments, agencies, and review bodies, civilian and military, involved in the collection, analysis, and dissemination of intelligence for the purpose of Canada’s national security;

(b) in the course of its work the committee should consider the methods of oversight adopted by other countries and their experiences and make recommendations appropriate to Canada's unique circumstances;

(c) the Committee be composed of 12 members, 7 from the Conservative Party, 4 from the New Democratic Party, and 1 from the Liberal Party, to be named following the usual consultations with the Whips and filed with the Clerk of the House...;

The committee's makeup would reflect that of the House. The motion also provided that:

(i) the special committee report its findings and recommendations to the House no later than May 30, 2014.

Canada is not the only country to consider parliamentary oversight of national security issues. The United Kingdom, Australia and New Zealand all have well-established systems that enable parliamentarians to ask the government for reports on national security issues. That is not the case in Canada. The only thing this Conservative Prime Minister has created is a cabinet committee on national security whose job is to supervise Canadian national security activities. However, this is a cabinet committee, not a parliamentary one, so it is not accountable to anyone.

If the Conservatives had really taken national security issues, protection of Canadians' privacy and problems related to CSEC disclosures seriously, they would have paid attention to this motion as soon as it was presented in the House, and we would already have a committee of elected representatives in place to deal with this kind of situation. Instead, the government is letting the problem persist and shows no interest in managing it. Worse still, in a recent report, the Privacy Commissioner suggested that privacy protection was not a priority for this government. That is shameful.

People have become distrustful. About 80% of Canadians are now connected to the Internet. People spend an average of 41 hours on the Internet a month. In terms of Internet use, we rank second in the world. In addition, the digital economy is growing fast. In 2012, Canadians spent $22.3 billion online. They already have serious doubts about how well their privacy is protected. Some 13% of people believe that their information is well protected on the Internet. If people can no longer trust that their own government will not spy on them, what or who can they turn to?

My colleague from Terrebonne—Blainville had also introduced an interesting bill on this, Bill C-475 on privacy protection. Canadian privacy laws have not kept pace with rapidly changing technologies, which is rather alarming. Those laws have not been updated since the first generation of iPods.

The purpose of Bill C-475 was to correct the situation by updating these laws and taking personal information protection seriously. We have the right to know when our personal information is gathered, used or communicated in any type of digital format. We have the right to feel safe. In that regard, this bill gave Canada's Privacy Commissioner increased law enforcement powers and made it mandatory to inform the persons concerned of any data leaks that might affect their privacy.

Canadians should not have to worry about the confidentiality of their personal information online. We must enhance our protection measures for children, for seniors and for all Canadians.

The NDP takes privacy protection and national security very seriously. We must protect the integrity of our country and ensure that people are safe. It is a matter of maintaining a delicate balance between liberty and security. National security is a top priority.

The government has a responsibility to make and apply policies to protect the country and its citizens, and not break its own laws and spy on the public. The fundamental problem with this government is the lack of openness and counterbalance. With our current institutional structure, we must make decisions for the common good and be more transparent to ensure that the right decisions are being made.

A number of the questions we have asked the Conservative government remain unanswered. Who authorized spying on Canadians through free Wi-Fi at a Canadian airport? Was the minister aware of this metadata collection program? Were these data saved? More worrisome yet, does this spying program still exist?

We sincerely hope that the Conservative government will go public with its legal reasoning and rationale behind CSEC's metadata collection operations. The Conservatives' vague answers will not do. We need clear answers.

Personal Information Protection and Electronic Documents Act

[The Speaker, Conservative, Andrew Scheer]

The House will now proceed to the taking of the deferred recorded division on the motion at second reading stage of Bill C-475.

The question is on the motion.

The House resumed from December 5, 2013, consideration of the motion that Bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), be read the second time and referred to a committee.

Votes on Bills C-475 and C-513

[The Deputy Speaker, NDP, Joe Comartin]

I would like to inform the House that, pursuant to Standing Order 94, the divisions on Bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), and Bill C-513, An Act to promote and strengthen the Canadian retirement income system, stand deferred until Wednesday, January 29, 2014, immediately before the time provided for private members' business.