Evidence of meeting #16 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was chairman.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Jennifer Stoddart  Privacy Commissioner, Office of the Privacy Commissioner of Canada
Wayne Watson  Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada
Tom Pulcine  Director General, Corporate Services and Comptroller, Office of the Privacy Commissioner of Canada

3:30 p.m.

Liberal

The Chair Liberal Tom Wappel

We have quorum. We like to start on time if our witnesses are kind enough to appear on time.

Pursuant to Standing Order 81(4), we're discussing the main estimates for 2006-07--in particular, vote 45, concerning the Office of the Privacy Commissioner under the rubric “Justice”, which was referred to the committee on Tuesday, April 25, 2006.

We have with us today, from the Office of the Privacy Commissioner of Canada, the Privacy Commissioner herself, Jennifer Stoddart. While I usually introduce people, I'm going to refrain from doing that and allow Jennifer Stoddart to introduce the people who are with her.

Ms. Stoddart, I understand that you have an opening statement, so by all means carry on, and then, naturally, as I'm sure you're used to, we'll go to questions after that.

3:30 p.m.

Jennifer Stoddart Privacy Commissioner, Office of the Privacy Commissioner of Canada

Thank you very much, Mr. Chairman and honourable members, for being here to hear our presentation on our budget.

I would like to present the director of investigations, Mr. Wayne Watson; and Tom Pulcine, who is the director of corporate services, and thus, a specialist in budget matters.

Mr. Chairman, I have an opening statement that's a little over 10 minutes in length. May I proceed with that?

3:30 p.m.

Liberal

The Chair Liberal Tom Wappel

Yes, you might as well and then get it over with faster.

3:30 p.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

I'm very happy to be here. I'm going to run through the history behind today's session, because it's rather surprising to note that in fact the money was recommended to us by a parliamentary panel just about a year ago, and in fact, we're here one year later on the main estimates for the same amount.

I'll be referring to the report on plans and priorities, which you have.

In both versions—French and English—this starts on page 3.

The details of how our money is spent are in that book.

We have, as you will have noticed, a 36% increase in our budget. This is due to several months of work, effort, and energy in preparing a comprehensive business plan. This plan, developed about two years ago, was developed with the assistance of an independent consultant and was based on an in-depth analysis of our situation.

We also consulted with the Treasury Board Secretariat and compared ourselves to several agencies with similar mandates, to draw on their best practices and experience. We looked at the needs of the organization as a whole and of individual branches and took into consideration our unique role as the Office of the Privacy Commissioner of Canada.

I'll remind you that we have a mandate to ensure compliance with two statutes. One is the Privacy Act, which governs the public sector; and the other one is the Personal Information Protection and Electronic Documents Act, which covers the private sector.

I understand that this committee was recently briefed by Treasury Board officials on the new funding mechanism for agents of Parliament. As I said, a year ago we had the opportunity to present our business case and our request for funding to this new panel. We are pleased that this panel and the Treasury Board Secretariat came to the same conclusion and recommended granting our request for the permanent funding necessary to carry out our mandate and our plan.

This plan places increased emphasis on investigations, education, and prevention in both the public and private sector. That adequate level of permanent funding recommended last year is reflected in the main estimates that are before you. We think they are absolutely crucial to fulfilling our mandate to protect the privacy rights of Canadians.

I should like briefly to explain the mission of the Office of the Privacy Commissioner of Canada.

Parliament has signaled the relevance and importance of privacy with the enactment of privacy laws and with the creation of the Office of the Privacy Commissioner of Canada. Privacy is a right seen by many as fundamental to other rights, including the right to autonomy, dignity and integrity of the person. The Office of the Privacy Commissioner of Canada protects and promotes the privacy rights of individuals on behalf of parliamentarians. That is our mission and we take it very seriously.

Increasingly, there are pressing and complex issues putting Canadians privacy at risk— the practice of sharing more and more personal information in the name of national security, personal data flowing around the globe, the use of technologies such as global positioning systems, biometrics, radio frequency identification devices and the potential of publicly available personal information being used by invasive and malevolent purposes.

I will continue with an explanation of the various aspects of our mandate.

My Office oversees compliance with the two federal privacy laws I just mentioned. We act as an independent ombudsman, and are probably best-known for our role as a complaints investigator. However, our responsibilities go far beyond reacting to complaints about possible privacy breaches. We use several other complementary powers in large part aimed at preventing such breaches . We are an investigator but we are also an auditor; a public educator and advocate, a researcher, and an expert privacy advisor.

As an auditor, in both the public and private sectors, we conduct audits and reviews, and verify compliance with privacy laws. We also work to educate governments, departments and businesses about the importance of protecting privacy and about their legal obligations to do so. We help the public better understand their privacy rights and act as their advocate when necessary. We conduct research on emerging privacy issues and use that expertise to advise Parliament, government and businesses. And, finally, we challenge the application and interpretation of the laws, and analyze the legal and policy implications of government proposals.

Privacy issues increasingly do not recognize national borders. Our mandate of protecting Canadians' privacy rights requires that we work more closely with our international colleagues to explore common approaches to the protection of personal information. I'm the chair of an Organisation for Economic Co-operation and Development--the organization known as the OECD--multinational group that is examining ways to foster international cooperation and facilitate the cross-border enforcement of privacy laws. We are also participating in efforts by the Asia-Pacific Economic Cooperation, APEC, to develop privacy guidelines. We will continue to work with our international colleagues to develop harmonized approaches, to share knowledge, and to build effective relationships. To that end, we will be hosting the international conference of data protection and privacy commissioners in September 2007.

I know many members of this committee have heard me outline our various mandates before. I'm doing so again today because I want to stress that we're using our permanent funding, which is the subject of our appearance today, to fulfill activities that are within our mandate. Our permanent funding is imperative in order to carry out the duties and responsibilities entrusted to us by Parliament.

I'd like to briefly recap the history of our financial situation, Mr. Chairman, because it's a bit unusual.

I am appearing here today with my staff to respond to any queries you might have about the new level of funding proposed in this year's main estimates. Before this, the level of permanent funding under the Privacy Act was made many years ago, possibly before 2000, maybe in 1997. The PIPEDA funding, which represents close to two-thirds of our annual budget, had been approved in 2001 for three years only and was renewed through supplementary estimates for the following two years as an interim solution.

We needed experience and time to evaluate the appropriate level of resources before making a long-term funding request and commitment. The resource levels in the main estimates now include the necessary funding for the Privacy Act and a renewal and an increase in funding for PIPEDA. We believe this permanent funding is adequate and necessary for the stability of our office.

I would like to now move to some of the recent actions of the office in order to improve the accountability of the OPC.

In the last few years, we have pursued an ambitious agenda to correct any deficiencies in the management of the organization. Audits and evaluations of our office by the Public Service Commission, the Auditor General of Canada, and the Canadian Human Rights Commission have all been positive. We have implemented a thoughtful, systemic process to determine our organizational needs. I believe this office is a stable institution now and is worthy of the trust of Parliament and the Canadians it serves.

Also on the issue of accountability, the proposed Federal Accountability Act, Bill C-2, will make our office subject to both the Access to Information Act and the Privacy Act for the first time. We support the spirit of this initiative, and this is a welcome step. But it will certainly have a further impact on our resources, and this is being examined at the present time.

I'd like to tell you about our priorities for this fiscal year.

Our top priority is still clearing a backlog of complaints. We are streamlining our investigation approach and building a larger investigation team, but we are faced with the challenges of recruitment, training, and an increasingly complex privacy landscape.

On the audit side, we are intensifying our activities to encourage greater compliance and to proactively assist in the development of a robust privacy management regime in both the public and the private sectors. For example, we recently completed an audit of the Canadian Border Services Agency, and we've launched two major private sector audits.

We've been initiating a number of more proactive communication efforts in order to meet our public education mandate.

We're also preparing the next international data protection and privacy commissioners conference.

In the meantime, our research branch is supporting independent privacy research projects on topics such as workplace privacy and health care privacy and initiating both internal and external research into emerging issues and trends to help citizens and policy-makers understand current challenges. With the issues becoming increasingly more complex and technology-driven, it is important that in addition to undertaking our own research, we draw on outside expertise.

The policy and legal services branch, of course, assists us in becoming more proactive and through OPC-led initiatives, notably in the courts, affecting systemic change in information-handling practices.

Last year, my office began taking a stronger stance with respect to recommendations made to private sector organizations in my letters of finding at the conclusion of an investigation. We began telling organizations that are the subject of well-founded complaints to implement our recommendations or we would take the matter forward to Federal Court. Unfortunately, there are no sanctions under the Privacy Act, which is one of the reasons it needs an overhaul. It's unacceptable that the private sector is held to a higher standard for privacy protection than the federal government. I think we should be an example and I refer you to a paper that we did, at the request of this committee, which we tabled with you in June. We look forward to presenting it to you at a further date.

In conclusion, the goal of our Office is to implement our business case within the next two years. At that point, we will need to take another look at our activities and funding needs. I believe we need to constantly challenge ourselves to find better ways to carry out our mandate and get the job done. And the privacy environment is constantly changing; we need to adapt with it. And our privacy laws need to keep up with the times.

We hope you will agree with the parliamentary panel's recommendation of last year. The increased permanent funding is necessary to ensure that we can effectively protect and promote privacy—the services we offer to Canadians on behalf of parliamentarians.

We want to do the best we can in carrying out the responsibilities that have been entrusted to us. And we need to have the tools to do our job of protecting Canadians' right to privacy.

This Mr. Chairman, brings to an end my preliminary remarks.

I would be very happy to take the questions you may have on our budget and our functioning.

3:45 p.m.

Liberal

The Chair Liberal Tom Wappel

Thank you very much, Madam Commissioner.

As usual, we'll begin with a seven-minute round, and we'll start with Mr. Peterson.

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Thank you, Mr. Chair, and thank you, witnesses.

We agree with you that not having sanctions under the Privacy Act is wrong, and I'd like to see amendments as quickly as possible.

You've talked about one of your big problems being your backlog of complaints. How big is that backlog in terms of numbers and time to resolve it?

3:45 p.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

May I ask the director of investigations, whom I brought in case you had questions about this, to answer that question, honourable member?

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Absolutely, yes.

3:45 p.m.

Wayne Watson Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada

Mr. Chairman, at this point today, I can tell you that we have 691 investigations in abeyance. We've opened 1,609 investigations, and we were able to close, last year, 1,287 investigations.

The backlog we recognize as a definite problem. We are revisiting the way we do our investigations. We are looking at different processes to see how we can reduce the time delays as far as administrative as well as operational processes are concerned. We have hired, so far, five new investigators, and I'm expecting to be able to hire seven more within the next few months. And I'm hoping that within the next 24 to 30 months our backlog should be reduced considerably.

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Did you say you get about 1,000 complaints a year?

3:45 p.m.

Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada

Wayne Watson

Yes, sir. Last year, I can tell you, we received 1,609 complaints that became investigations.

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Can you give me some idea of where most of those complaints come from? What's the nature of them?

3:45 p.m.

Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada

Wayne Watson

I can tell you—and I'm talking about in 2005—1,200 of those complaints were under the Privacy Act and 400 from the private sector under the PIPEDA.

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Can you give me an example of what the complaints would be and where the alleged violations took place?

3:45 p.m.

Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada

Wayne Watson

Most of them concern time limits, how long it takes a department or an organization to give the service to the individual asking for their personal information. Many of them also concern their refusing access to individuals to their personal information. We have also--

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Which institutions are the big offenders?

3:45 p.m.

Director General, Investigation and Inquiries Branch, Office of the Privacy Commissioner of Canada

Wayne Watson

The greatest number of complaints does not necessarily mean the biggest offenders, but right now we know that the organizations with the greatest number of complaints are the RCMP, the CRA, and I believe the next one is Canada Border Services Agency. The reason is simply that these organizations have the greatest amount of personal information, so it is normal that we'd have the largest number of people asking for their personal information from these organizations.

3:45 p.m.

Liberal

Jim Peterson Liberal Willowdale, ON

Thank you.

3:45 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

As you already mentioned, in your office budget, planned and unplanned spending to cover Bill C-2, are not included. In other words, they are not part of your current forecasts. However, we know that this bill will create additional work for your office.

I should like to know whether or not you have already assessed somewhat the amount of work and of spending that this is going to necessitate?

3:50 p.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

We are in the process of attempting this exercise with a lawyer and an accountant. So, we have not yet finished this estimate but we must remember that a great number of organizations are involved. Just before coming here, I did ask what the number was but they are still in the process of figuring it out.

Given the number of organizations that we are going to cover through the Privacy Act and which will file complaints with our services, and in view of the impact of access to information on our services, we can imagine that the number of inquiries and requests for information on our cases will be significant. It might even be quite substantial.

3:50 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

Regardless of the fact that there are several other organizations, what procedure do you follow to assess them? Do you set a percentage to each of the organizations? How does this work exactly?

3:50 p.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

In order to assess the costs?

3:50 p.m.

Bloc

Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC

In order to assess how much this is going to cost you? What are your parameters?

3:50 p.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Perhaps the Director General of Corporate Services could tell us exactly what are the parameters. I assume that we are considering what the other organizations are doing.

3:50 p.m.

Tom Pulcine Director General, Corporate Services and Comptroller, Office of the Privacy Commissioner of Canada

Wayne, you could help me out here. With respect to Bill C-2, we've been trying to understand the new organizations clearly. The very first step is to determine whether the new organization covered by the Privacy Act is in fact already covered by PIPEDA, because if it is covered by PIPEDA, it would have no impact in terms of our resources.

The second thing we're looking at is the type of organization it is. We look at whether it's an organization that, first of all, has a large volume of employees, because presumably there's a correlation between the number of employees and the number of complaints we could possibly have. The other aspect of the organization profile we look at is the extent to which they are resource-intense with respect to personal information. If they are, once again they're deemed likely to have an impact larger than an organization that doesn't have very much personal information.