Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

[Scott Smith, Director, Intellectual Property and Innovation Policy, Canadian Chamber of Commerce]

Thank you, Mr. Chairman and members of the committee. The Chamber of Commerce appreciates the opportunity to address you on the subject of Bill S-4 and the changes that are proposed for the Personal Information Protection and Electronic Documents Act.

There has been much effort exerted in crafting this bill. As you're aware, there have been several iterations of it over the past few years. This is certainly not the first attempt at making changes to what is arguably the envy of other countries that are now just waking up to the principle of accountability.

This is principles-based regulation, and it provides guidance to business regarding their privacy obligations, avoiding overly prescriptive rules while at the same time permitting the necessary level of flexibility that leads to innovation.

In short, PIPEDA is a balance. Making legislative change without tipping that balance is a delicate matter. We would argue that the changes proposed in Bill S-4 are a successful attempt at maintaining the balance. The recommendations I'm going to be providing are very much procedural in nature and are not intended to fundamentally alter the spirit or intent of the bill. I'd like to characterize my comments as an opportunity to draw the committee's attention to specific provisions of the government's proposal that might benefit from targeted revisions that would align the changes to current industry practices while still meeting the government's objectives.

We support the objectives of Bill S-4 and the various proposed changes to PIPEDA that will bring some additional certainty and improvements to the overall PIPEDA framework, such as the new provisions regarding disclosure of personal information in the course of business transactions. These would broaden the scope of the exemption for business contact information to cover any information that is used to communicate or facilitate communication with an individual for business, employment, or professional purposes.

We are proposing targeted changes in four specific areas: one, valid consent; two, breach notification thresholds and record keeping; three, public disclosures; and four and perhaps most important, network information security.

The new valid consent provision in Bill S-4 denotes an obligation on organizations to pay particular attention to vulnerable individuals. While this is principles-based and broad in scope, the narrative around this provision has focused on specific categories of individuals. We see this as a concern for organizations that market broadly.

We also see it as unnecessary. I think you heard from the Privacy Commissioner this morning as well that this is a provision that, while he suggests it may be useful, isn't necessarily required. Section 5 of the act obligates every organization to comply with the model code, which is schedule 1. Section 4.3.2 of the model code says that for consent to be meaningful, “the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed”. In our view, this principles-based approach already captures the intent of Bill S-4, and we think the bill could be improved by simply deleting that clause.

The objective of notifying individuals in order to mitigate the risk of significant harm is quite different from the objective of notifying the Office of the Privacy Commissioner in order to catalogue breaches. This distinction is captured in the OPC guidelines from 2007 that define a real risk of significant harm and what constitutes a material breach. This dual threshold has been in practice for over a decade and is working well. In these cases there is no material breach, and the OPC reporting requirement would be onerous for both the organization and the OPC.

We encourage language that allows organizations to assess the risks associated with a breach and the OPC to issue guidance on what constitutes a material breach that triggers a reporting requirement, in other words, the existing regime.

Because there is no definition of what constitutes a material breach, record keeping is also problematic. Many occurrences, such as an unlocked filing cabinet with employee records, technically constitute a breach but have no material consequences. Keeping records in the prescribed manner for an unspecified time period when there is no impact on the privacy of an individual and the failure to keep those records constitutes a criminal offence is an unreasonable burden on organizations.

Also, with respect to what constitutes a material breach, we note that the compliance agreements should be directly linked to and focused on the requirements of PIPEDA to ensure transparency and clarity in the act regarding what companies must do to avoid finding themselves in a situation that might warrant a compliance agreement in the first place.

As drafted, proposed new section 17.1 raises concerns that overly broad language, for example, “any terms”, could result in potential jurisdictional overreach by the Privacy Commissioner. This limitation should be accompanied by a reasonable notice period.

Also, in clause 17, we are concerned that an exception to the general prohibition on disclosure granted to the Privacy Commissioner is out of step with other Canadian statutes, such as the Competition Act, and may have the unintended consequence of undermining current cooperative relationships and information sharing.

I've just spoken about the modifications we're recommending. We believe there's one very important omission in Bill S-4 that does warrant your consideration, which brings me to network information and security. The average number of days that a threat can reside on a network undetected is 229, and networks extend beyond individual organizations.

On February 13, President Obama issued an executive order calling for improved private sector cybersecurity information. This order recognizes that countering cyberthreats, private companies, not-for-profit organizations, executive departments and agencies of the government, and other entities must be able to share information related to cybersecurity risks and incidents and collaborate to respond in as close to real time as possible. We believe the same mechanisms are necessary here in Canada.

While proposals under Bill S-4 provide some limited exceptions to allow for collection, use, and disclosure of personal information, changes are needed to provide organizations with a legal certainty to effectively manage these threats. We are interpreting that network information security processing falls within the scope of PIPEDA since data processed for network information security purposes is often personal information like a name, an IP address of a botnet zombie computer, or an e-mail address. We are essentially asking for a clear-cut exception for network security information processing so that organizations have legal certainty and aren't forced to curtail network information security processing or operate in a legal grey area.

Our specific recommendations for text changes were submitted by the Canadian Chamber of Commerce on behalf of a coalition of businesses and organizations, and I urge you to consider those recommendations in the spirit of crafting the most effective privacy legislation.

Thank you for your consideration.

[Daniel Therrien]

We have done that in the form of guidance to organizations, asking organizations to use plainer language when they seek consent. That's obviously only an incomplete answer, but at the end of the day, it is organizations that know the service they are providing and know what kind of information they need, so they're in the best place to inform consumers and individuals. We're urging them to use as plain language as possible.

That being said, consent is a huge concern. We think that Bill S-4 is a step in the right direction with the clarification to the definition found in it. But as I indicated before, we're consulting stakeholders on what our priorities should be for the next several years on how best to improve the situation for individuals. The consent that they provide will almost certainly be among our priorities.

[Daniel Therrien]

I would say that we have worked on complaints involving children, and we have been able to set certain parameters for how to obtain consent when the services provided by the organization are of interest to children, so it's not that we are currently without any tools to ensure the ability of consent generally and for children specifically.

That being said, I think it is useful to provide, to have the clarification that Bill S-4 proposes to have so that organizations see clearly from the definition of consent in what would be the new provision of PIPEDA, that they have to think about the clientele to which they're offering products and services. This probably is happening to some extent. Certainly it's happening to some extent for organizations, but it may not be happening for all organizations, and to have this clearly in legislation, that you must think about your clientele, I think would be useful.

Is it that are we without tools currently? No, but it would be useful to have this addition.

[Peggy Nash, NDP, Parkdale—High Park, ON]

I'd like to pursue the questions of Mr. Warawa around consent, because it is a topic that is certainly addressed in Bill S-4, and it's a very important topic that most people truly don't understand in an era of rapidly changing technology.

I discovered to my surprise that I ended up owning one of these TVs. It's a good thing I never get to watch it, but it apparently has the potential to be allowing someone to listen in. It would be pretty boring, but....

I wanted to ask you specifically about children. You did mention the consent of children. We're going to be hearing from the Chamber of Commerce, and they have said in their submission that your office has not been hampered in its efforts to protect children through ensuring valid consent; therefore, a specific valid consent amendment is not needed. What's your view on that? We'll ask this question also to the chamber, but do you believe that a specific valid consent amendment for children is needed?

[Daniel Therrien]

We could spend a whole day on this issue of consent. Obviously, whether people provide consent with all knowledge of the consequences of their giving consent is a huge issue, and in many, many cases consumers, individuals, do not realize what they are consenting to. There's no question about that.

How does one ameliorate the situation? We think education is a big part of it. Guidance from the office is a big part of it for organizations and individuals. Is it possible to legislate this? The proposed definition of consent in Bill S-4 I think is a useful addition, but obviously you cannot prescribe all the potential situations where consent will be sought in the marketplace, so legislation has its limits. I think with the clarification that Bill S-4 provides, it is a useful clarification of what consent is, and it has the potential of improving the situation for the issue of consent sought from children, because the definition in Bill S-4 requires organizations to put themselves in the shoes of the individual whose consent is being sought: what does the individual understand? So, when the individual is a child, if your product is addressed to children, you should think about what is reasonable to expect of a child in understanding the consent being sought. Overall, I think, again, the definition of consent in Bill S-4 will assist generally and will assist particularly groups that are more vulnerable, like children.

[Annick Papillon, NDP, Québec, QC]

Very well.

Bill S-4 could force private sector organizations to report any losses or breaches of personal information. However, unlike what is set out in Bill C-12, the test proposed for this mandatory reporting is subjective since it enables the organizations themselves to determine, and I quote:

if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

In your view, is that test reasonable?

[Annick Papillon, NDP, Québec, QC]

Thank you, Mr. Chair.

When Minister Moore appeared before this committee a few days ago, I asked him whether the office would have sufficient resources and funds to accept the new and major responsibility that will follow once Bill S-4 is passed. He said that you had the resources you need for that.

Is that really the case?

[Daniel Therrien]

The first point I would make is that we can devise a breach notification regime in any number of ways. The one that you have in front of you is a good compromise. It's reasonable. Is there a better system conceivable? Probably. What I would ask you to do is to adopt that regime because the main point is we need mandatory breach notification.

Is it appropriate to leave organizations with the duty or the discretion to notify or not? In practical terms, we see that in Alberta, which has a similar scheme, but also federally with the voluntary breach notification that we've enforced for the past few years, organizations by and large do not under-report. They over-report. They want to report borderline cases because they don't want to be seen as under-reporting. Moreover, in Bill S-4, there will be penalties for those who under-report. Again, is this the best regime possible? Maybe, maybe not. I think it's reasonable overall and should be adopted.

[Daniel Therrien]

I reiterate what I answered to Madam Nash, namely, yes, C-13 and S-4 on the issue of warrantless access to information create challenges and issues.

The decision of the Supreme Court in Regina v. Spencer is extremely useful and sets good parameters. I think it would be useful to go a step further and to further clarify lawful authority with a combination of the decision of the Supreme Court in Spencer plus a clarification of the circumstances where government can collect without warrant when there's no reasonable expectation of privacy. I think that would be a reasonable regime.

[Judy Sgro, Liberal, York West, ON]

The combination of C-13 and S-4, the impact of both of those pieces of legislation will be fairly significant, from what I understand.

Do you have any additional concerns over what you have mentioned specific to S-4 once those two are combined?

[Judy Sgro, Liberal, York West, ON]

We're glad to have you here.

I have a couple of questions.

How are Canadians going to be better off with Bill S-4? We know certainly some of them...front level, but I'm concerned with some of the other possible breaches and your ability as a department to pursue them.

[Daniel Therrien]

It's for two reasons, essentially.

Point one, I totally agree that there needs to be provision in PIPEDA allowing organizations to address the issue of fraud or breaches of agreements that they may face. The question is how to do it. The current regime, I think, is preferable to what is proposed in Bill S-4 in that, first, it does not allow for fishing expeditions, so that the threshold for the suspicion an organization has that there might be fraud involved is at a higher level, which I think is preferable. Second, the investigative body regime calls for transparency and publicity—we know what the investigative bodies are—as opposed to the proposed modifications whereby any organization could share information with any other organization, so that there would be less transparency, as well as room ultimately for fishing expeditions.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair. Good morning, members of the committee.

Thank you for the invitation to present our views on Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act.

With me today are Patricia Kosseim, senior general counsel, and Carman Baggaley, senior policy analyst.

Ms. Kosseim and Mr. Baggaley appeared before the Standing Senate Committee on Transport and Communications on Bill S-4, shortly before my appointment as Privacy Commissioner was confirmed. My views on Bill S-4 are largely in line with the office's position as presented at that time.

I will however be addressing in more detail the proposed amendment that allows organizations to disclose personal information to other organizations without consent. I will also discuss paragraph 7(3)(c.1) disclosures in light of the Supreme Court's Spencer decision.

Let me first say that I am greatly encouraged by the government's show of commitment to update the Personal Information Protection and Electronic Documents Act, and I generally welcome the amendments proposed in this bill.

Proposals such as breach notification, voluntary compliance agreements and enhanced consent would go a long way to strengthening the framework that protects the privacy of Canadians in their dealings with private sector companies.

Mandatory breach notification will bring enhanced transparency and accountability to the way private sector organizations manage personal information. I support the risk-based approach that will require organizations to assess the seriousness of each incident and its impact on affected individuals.

I believe that the organization experiencing the breach is in the best position to assess risk and decide whether notification of individuals is warranted. Requiring organizations to keep a record of breaches and provide a copy to my office upon request will give my office an important oversight function with respect to how organizations are complying with the requirement to notify.

The proposed voluntary compliance agreements will enhance my office's ability to ensure, in a timely and cost-effective manner, that organizations are meeting their commitments to improve their privacy practices without having to resort to costly litigation before the Federal Court in conditionally resolved cases.

As for the proposed provision that aims to enhance the concept of valid consent, I believe that this is a useful clarification of what constitutes meaningful consent under PIPEDA. It underscores the need for organizations to clearly specify what personal information they're collecting and why in a manner that is suited to the target audience.

While I support many of the amendments proposed in this bill, I nevertheless have strong reservations about proposed paragraphs 7(3)(d.1) and (d.2). These proposed provisions would allow an organization to disclose personal information without consent to another organization in certain circumstances. My concerns are twofold.

First, I believe that the investigative body regime as it currently exists in PIPEDA and which paragraph 7(3)(d.1) and (d.2) seek to replace provides important transparency and accountability safeguards that will disappear with the proposed amendments.

Currently under PIPEDA, organizations can disclose personal information without consent to investigative bodies designated through a transparent governor in council process. The list of organizations with investigative body status is publicly available. Under the proposed amendments, potentially any organization will be able to collect or disclose personal information for a broad range of purposes without any mechanism to identify which organizations are collecting or disclosing the information and why.

Furthermore, the proposed provisions seek to dilute the thresholds and grounds for disclosure that currently exist under the current investigative body regime in paragraph 7(3)(d). I would prefer to maintain the existing investigative body regime. However, if that is not possible, then I would recommend keeping the existing PIPEDA thresholds found in paragraph 7(3)(d) and grounding disclosures in real problems rather than fishing expeditions.

This would mean three things: first, the threshold under paragraph 7(3)(d.1) should be based on a “reasonable grounds to believe” that the information relates to an actual breach or contravention; second, the threshold under paragraph 7(3)(d.2) should be based on a “reasonable grounds to believe” that the information relates to the detection or suppression of fraud that “has been, is being or is about to be committed”; and third, disclosures under paragraphs 7(3)(d.1) and 7(3)(d.2) should only be permitted on the initiative of the disclosing organization.

In addition a mechanism for enhancing transparency and accountability around these disclosures would be needed. For example, disclosing organizations could be required to issue transparency reports and to document the analyses undertaken in deciding to disclose under these provisions.

Finally, I would like to address the Spencer decision and how I believe it impacts paragraph 7(3)(c.1 ) of PIPEDA.

ln the Spencer decision, the Supreme Court held that police need a warrant or a court order when seeking subscriber information from an organization subject to the act.

ln the court's view, there is a reasonable expectation of privacy in subscriber information connected with online activity and the police request that the organization voluntarily disclose this information constituted a search that violated the Charter. I believe that this decision is a significant step forward in protecting privacy, but it leaves unanswered the question of what types of information attract a reasonable expectation of privacy and the related question of when organizations may voluntarily disclose other types of information in response to a police request.

As a result, organizations are left in a state of uncertainty and ambiguity as to when they may or may not disclose personal information without warrant and it leaves individuals in the dark about when their personal information may be disclosed to state authorities without their consent or prior judicial authorization.

I would therefore urge the committee to recommend putting an end to this state of ambiguity by clarifying when, post-Spencer, the common law policing powers to obtain information without a warrant may still be used. I believe that a legal framework, based on the Spencer decision, is needed to provide clarity and guidance to help organizations comply with PIPEDA and ensure that state authorities respect the Supreme Court of Canada's decision.

More specifically, I would recommend that Parliament provide greater clarity and transparency by amending PIPEDA to define “lawful authority” for the purposes of paragraph 7(3)(c.1) in line with the Supreme Court's decision, that is, where there are exigent circumstances, pursuant to a reasonable law other than paragraph 7(3)(c.1), or in prescribed circumstances where personal information would not attract a reasonable expectation of privacy.

Thank you for your attention. I would be happy to answer any questions you may have.

[The Chair, Conservative, David Sweet]

Good morning, ladies and gentlemen.

Welcome to the 34th meeting of the Standing Committee on Industry, Science and Technology where pursuant to the order of reference of Monday, October 20, 2014, Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act, is what our study is right now.

We are grateful to have before us the Privacy Commissioner of Canada, Daniel Therrien. With him are Patricia Kosseim and Carman Baggaley.

We have a second panel at noon, colleagues, so we will begin with the Privacy Commissioner's testimony and then our rounds of questions.

Mr. Commissioner.

[Peggy Nash, NDP, Parkdale—High Park, ON]

Thank you, Mr. Chair.

Again, I want to emphasize that I think there are many provisions in this bill that Canadians are looking for and feel are long overdue, and they are happy to see. I think it's unfortunate that there are some other provisions in this bill that are creating a lot of concern. Canadians are very concerned about their digital privacy, which is why this bill is being brought in. Yet, the area of warrantless disclosure is one that has been highlighted. It was highlighted at the Senate committee. While there may be absolutely legitimate areas where it makes sense to have warrantless disclosure, it's the lack of oversight that's troubling here.

I just want to cite quickly a couple of pieces of testimony on Bill S-4. First of all, Peter Murphy, who is a partner at a Canadian law firm, Gowling Lafleur Henderson, says again there are some welcome changes in Bill S-4. But he also goes on to comment in particular on the provisions allowing for disclosure of personal information without consent between organizations in support of investigations and breaches of law agreements or fraud cases of financial abuse, and I'm quoting:

This change would seem to permit fishing expeditions by companies seeking to sue individuals. For example, copyright holders would have grounds to freely obtain lists of internet addresses of individuals to find and sue internet downloaders. This seems to be a significant invasion of privacy if reasonable controls are not added to the proposed wording.

Michael Geist, who is a law professor here at the University of Ottawa, is an expert on digital matters, and he says:

Unpack the legalese and you find that organizations will be permitted to disclose personal information without consent (and without a court order) to any organization that is investigating a contractual breach or possible violation of any law. This applies both past breaches or violations as well as potential future violations. Moreover, the disclosure occurs in secret without the knowledge of the affected person (who therefore cannot challenge the disclosure since they are not aware it is happening).

So, my question is, why is there not greater accountability, greater oversight, to ensure that this provision, if you do believe it is necessary, is not abused?