Slide 13 sets out responsibilities for the Governor in Council. Some of these are very important to the functioning of the act. One of these powers is to make regulations to specify investigative bodies. A number of steps have been taken over the last few years to recognize private sector organizations that, by virtue of their responsibilities in legislation or in law, have to investigate and therefore have to both collect and disclose personal information
A second regulation power is to specify or define publicly available information. These are measures we can talk about in more detail. They're all contained in the regulations that have been distributed to the committee. You can find in there the operating definitions of publicly available information as well as all our investigative bodies' regulations.
The Governor in Council may also, by order, bind agents of the Crown to the act. This was really just a housekeeping measure, Mr. Chairman, in 1998 to ensure that certain crown corporations that were not subject to the Privacy Act would be subject to PIPEDA. This was to make sure there weren't gaps in federal crown corporations' being governed by privacy rules in one domain or the other.
The second power is to exempt from the act organizations that are deemed to be subject to substantially similar provincial privacy rules. The policy published in the Canada Gazette in August 2002 on that is also contained in your documentation, I believe.
Substantially similar, as we go to slide 14--and this may be worth focusing on for a moment--was a means Parliament put in place for aligning federal and provincial privacy laws around a single set of ground rules for data protection. Those rules would be the CSA model code, and they would apply across the economy as a whole.
In paragraph 26(2)(b), you see a power whereby the Governor in Council can exempt organizations that are subject to provincial laws considered “substantially similar”. In this case, the provincial regime for privacy protection would apply within that province, rather than the federal law.
The established criteria for “substantially similar” were to incorporate the CSA model code—those 10 principles—to provide for independent and effective oversight, and to restrict the collection, use, and disclosure of personal information to purposes that are appropriate or legitimate.
You'll see on the bottom of the slide that four provinces now have substantially similar provincial laws in place, and therefore those provinces have exemptions from PIPEDA: Quebec in 2003; the provinces of Alberta and British Columbia in 2004; and Ontario, in respect to their Health Information Protection Act, in 2005. So four laws have been recognized as substantially similar.
Essentially what this does is accommodate provinces that choose to legislate in respect to privacy protection, while allowing the federal law to apply in those provinces that choose not to do so.
As I mentioned, the Quebec privacy law was recognized as substantially similar in 2003. The Province of Quebec, however, has given notice of a constitutional challenge to part 1 of PIPEDA, which has to do with the clarification of the federal trade and commerce power in relation to provincial jurisdiction over property and civil rights. Although some documents have been filed, Mr. Chairman, the court still has not heard the constitutional reference. We expect that will occur sometime later in 2007.