Information & Ethics Committee on Nov. 22nd, 2006

[Richard Rosenberg]

I'm not sure exactly how to phrase this, but I guess it's a political comment. It seemed necessary, for a variety of reasons, for the B.C. government to outsource health information from the start. I would have asked if they took into account sufficiently the kinds of questions you're asking. Down the road, are you going to do this? Are you going to have to sue companies that violate? How much do you actually save at the end of the day by outsourcing it, especially by not keeping medical information in-house?

The government felt at the time that there were sufficient savings to reduce that part of the bureaucracy, and that was the way to go. I wonder indeed whether or not the questions were asked: so suppose we find violations, and how far are we willing to go to pursue recompense for those violations?

[David Tilson, Conservative, Dufferin—Caledon, ON]

Do you have an opinion on that?

[Richard Rosenberg]

You have to go as far as you need to go. If you contract with a company and it violates the agreement by either storing it where it shouldn't be stored or allowing access that is not allowed by the law, you have to go to the limit of the law in pursuing those companies.

[David Tilson, Conservative, Dufferin—Caledon, ON]

On the issue of mandatory reporting regulations on security breaches--in other words, a debit card or credit card violation is discovered--should those records be kept when they deal with and solve the fraudulent activity? Should it be mandatory that records be kept that the activity occurred, because the same thing could conceivably occur down the line years later? Do you know what I'm saying? That sort of requirement is in the United States.

[Prof. Colin Bennett]

Yes, but the American laws demand notification of consumers. Is that your question? Many of them do--they differ. If there's a security breach, the individuals affected have to be notified that this has occurred so they can take appropriate steps.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Yes. Then one asks the next question: should that security breach be kept on record, or is that the end of it? If you don't keep it on record, someone who is doing that fraudulent activity could conceivably do it again with the same information years later.

[Prof. Colin Bennett]

Who would keep it on record? I think that's the question.

[David Tilson, Conservative, Dufferin—Caledon, ON]

I'm throwing that question out to you.

[Prof. Colin Bennett]

On my preferred solution to this issue, I know a bit about the way the American laws are not working.

[David Tilson, Conservative, Dufferin—Caledon, ON]

That's one of them.

[Prof. Colin Bennett]

For example, I learned that in some states when a security breach occurs, the companies concerned notify the consumers and take it as an opportunity to give a marketing pitch. You know, “You've lost your data, and by the way, would you like another mortgage?”

On my preferred solution to this, the mandatory notification would be to the Privacy Commissioner, who would then make a judgment about whether the breach was significant enough for the notification of consumers to take place.

[David Tilson, Conservative, Dufferin—Caledon, ON]

I have one final question.

[The Chair, Liberal, Tom Wappel]

I'm sorry, it's seven minutes already, Mr. Tilson.

May I ask two questions please? We've heard a lot about work product. It's my understanding that work product has been defined in the B.C. legislation. Is that correct? If so, what is the definition in the B.C. legislation and how is it different from what we have?

[Prof. Colin Bennett]

I don't have that in front of me right now.

[The Chair, Liberal, Tom Wappel]

Could you provide it to us?

[Prof. Colin Bennett]

Of course.

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Rosenberg, you've recommended giving the commissioner order-making powers. There's been a suggestion that we take this right out of the hands of the Office of the Privacy Commissioner and give it to some special tribunal of some kind to deal with complaints and business respondents. That would leave the Privacy Commissioner to focus on the educational aspect, systemic privacy protection, and that sort of thing.

Having made the recommendation that the Privacy Commissioner have order-making powers, are you comfortable that the Privacy Commissioner, as currently set up, is going to be able to do this under PIPEDA along with the other things she has to do under the Privacy Act? I'm asking the question of both of you. What do you think of the idea of a specialized tribunal and taking it out of the hands of the Privacy Commissioner? I'm assuming in my question that the specialized tribunal would have order-making powers.

Mr. Rosenberg.

[Richard Rosenberg]

I'm influenced mostly by the operations in B.C. and Alberta, where it is in the office. The office makes the orders. I see no reason why that couldn't function in Canada.

I'd be willing to listen to arguments on why a tribunal is a better way. I can see it in a way. It allows the office to focus. It doesn't get into this controversial or the continual legalistic process. But I don't see why it would not be a legitimate activity in the Privacy Commissioner's office. I know reasonable people could differ reasonably on this, but it seems to me that you need a parallel institution with as much expertise on the privacy issues as you already have in this office. Why couldn't this office's powers be extended—with additional funding, I would guess—to carry out those orders if necessary?

[The Chair, Liberal, Tom Wappel]

Thank you.

Professor.

[Prof. Colin Bennett]

In my written submission that you will be receiving, I do discuss this a little bit, and I'll provide you more information about it.

The argument in favour of a tribunal is that you take the judicial function away from the Privacy Commissioner and the Privacy Commissioner maintains the ombudsman's role. You can also give it to a group of experts on the subject. This is the way the system works in the United Kingdom, and I'll give you information about how the British system works under the Information Commissioner and their Information Tribunal.

I think the Canadian Bar Association has come out in favour of such a model that is based on the Canadian Human Rights Commission and the Canadian Human Rights Tribunal. I'm not an expert on that, but I understand that it has led to delays. The perception is that it's just one other step on the way to a court, and I certainly wouldn't be in favour of establishing such a tribunal if it were of that nature. I am aware that there are arguments in the literature in favour of tribunals and that there may be a way one can be constructed in this situation, which would avoid the problems that the Canadian human rights area has. But at the moment, my preference would be some quite specific order-making powers for the Privacy Commissioner, and then an appeal to the Federal Court directly.

[The Chair, Liberal, Tom Wappel]

Thank you.

Given the time, could we have some very succinct questions and short answers please?

Mr. Wallace, Madame Lavallée, and Mr. Tilson.

[Mike Wallace, Conservative, Burlington, ON]

I have one quick question. On the order-making powers that you were just talking about, can you give me some examples of what the penalties would be and how they would be enforced? It's not just to say that you have the power, but how you're going to deal with it.

[Prof. Colin Bennett]

I'm not an administrative lawyer and I couldn't get into the details, but in most other jurisdictions there is a power to say, for example, “Stop doing that. Stop collecting that information.” That, as we argue, typically provides the incentive to comply at an earlier stage in the process.

The role of penalties in this area of law is a tricky one, because, to a large extent, the penalties that are imposed or the penalties that are perceived by a non-compliant organization are not necessarily financial. As I said before, they are as a result of lack of reputation and bad publicity.

There are plenty of models in Canada and there are plenty of models in B.C. and Alberta—and you will receive information about those pieces of legislation as well—where there are quite precise order-making powers concerning cease-and-desist and other functions like that. Those can assist the entire investigation and ombudsman function.

[Mike Wallace, Conservative, Burlington, ON]

Thank you.

[The Chair, Liberal, Tom Wappel]

Madame Lavallée.