Evidence of meeting #18 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
Exactly, since you are from British Columbia, you must be better informed about the Privacy Act of that province.
Political Science Professor, University of Victoria, As an Individual
I'm not getting translation at the moment.
November 22nd, 2006 / 4:20 p.m.
Liberal
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
You are analysts and managers of the Personal Information Protection and Electronic Documents Act in British Columbia. I would like to ask a few questions of a practical nature. We hear a great deal of talk about laws, regulations and monitoring with a view to determining how the federal act can be improved upon.
First of all, with regard to the protection of privacy, electronic documents or the use of various electronic media, do you get the impression that the general public is sufficiently well informed to understand the different issues and the risks of the various modes of communication?
For example, when citizens use a credit card, a cell phone, the Internet, shop via the Internet, satellite transmissions, etc., do you believe that they are really aware of the risks? Tell me about your experience in British Columbia.
Liberal
The Chair Liberal Tom Wappel
We'll let Mr. Rosenberg speak first, since you've been going for a while, Mr. Bennett.
President, B.C. Freedom of Information and Privacy Association (FIPA)
Probably not, in general. The Internet itself presents a mystery for most people if they arrive to it without understanding how it operates. For example, a few years ago no one I talked to knew what “cookies” were. They thought it was the usual thing. That's because when we buy a computer, cookies are automatically set as default. You never see the word “cookies”. It's not there. Information is being gathered to every website you visit, and that's not known. Then, of course, you start receiving information. “Spam” has become a common term now for the vast amounts of information sent to people, because information is being gathered from their activities and is unknown to them.
Everywhere you go.... The most common search engines gather information about your searching behaviour. Google has enormous amounts of information about all of us, about how we search, the things we're looking for. The argument, of course, is that they want to improve their methods, they want to be more responsive. That's always the argument for gathering information: it's for your benefit, because you need better access, better quality of information and so on.
The question here is, how do people become informed about all this? Who's going to tell them? Well, you might think you could go to a website and look up the privacy policy of the people who are running the website. They vary from being totally incomprehensible to saying nothing. Mostly that's the case, because most Canadians go to U.S. websites and there are no privacy regulations in the U.S. You depend on the private sector to perform admirably because they don't want a black eye from being accused of something.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
Does it not become the role of the government to better inform people, since, as you say, the public is basically poorly informed? Doesn't the government have the important role of advising the public of the risks associated with the use of these various electronic tools? It seems to me that that should be its role, since in the law, we want to monitor e-commerce and the different transmissions.
Wasn't there an oversight in terms of informing the public? Shouldn't the provinces and the federal government, which wants to improve its legislation, examine this major oversight?
President, B.C. Freedom of Information and Privacy Association (FIPA)
I think it's not solely legislation. I think what's important--and I think I addressed it very briefly in one of the recommendations I made--is that the offices of the privacy commissioners, both federally and provincially, should have, as part of their responsibility, education of the public about where there are threats to privacy. I think that would probably require more money going into hiring more people to go out and spread the word by a variety of means.
Of course, this ties into other issues about making public the fact that when there are privacy violations, people should hear about them. They shouldn't be behind the scenes and then some newspaper reporter discovers it and tells you about it. This is an ongoing education process. The Internet is a technology, I think, that appeared with such rapidity that there was hardly any time to adapt to it and discover some of the issues related to it.
Political Science Professor, University of Victoria, As an Individual
Maybe I could say something from some of the survey evidence that we have in Canada about what individuals think about privacy.
It is true that the vast majority of Canadians do not know about the legislative protections and do not know about the recourses that are available to them. On the other hand, it is also true that the vast majority of Canadians are extremely concerned about this issue. Vast majorities have experienced serious privacy invasions and a good number understand the issue instinctively. They know that when an organization is capturing information about them that they regard as illegitimate, they have a very instinctive attitude that it's none of your business.
Now, those attitudes will vary by gender, by generation, and to some extent by province, but I think the education is part of a larger set of tools that is needed in order to implement privacy in Canada. This is one of my larger points. The law is only one of many instruments that need to be used these days in order to give individuals greater control over the personal information that circulates about them. One is obviously information and education; another one is a lot of self-regulation that businesses can do on their websites and so on. There are also privacy-enhancing technologies, such as encryption tools, that can be used. The law is simply one part of that set of instruments.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Thank you, Mr. Chairman.
It's interesting talking about all this business, because on the one hand these are very Orwellian thoughts.
My friend here is using a BlackBerry, and I understand that if you're in a private meeting you'd better leave your BlackBerry outside the room, because someone can use it as a transmitter. If you have some confidential information, and you're on your cellphone in the Centre Block, you'd better be careful you're not blabbing too much, because someone can pick it up. It's rather frightening. On the other hand, people don't seem too concerned about security at airports, having cameras in convenience stores, banks, airports, because they're worried about their personal safety.
When you're talking about all these things, we say we have to protect our privacy, but on the other hand—and you say the public is concerned about that—the same public is also interested in protecting personal safety and has absolutely no problem being searched at the airport and practically strip-searched at the airport. They are terrified something's going to happen on a plane or other places. They are concerned about going into a convenience store and some strange thing happening there, so they don't mind the cameras being there. Can you go too far either way?
Political Science Professor, University of Victoria, As an Individual
Yes.
With respect, there's a good deal of survey evidence that suggests individuals are concerned about new technologies and their use for surveillance purposes when they do not see a legitimate public purpose. When I talk to audiences, including my students, and I begin to ask them questions about the capture of this personal information, the concerns increase the more they know about the way the technology might be used.
For example, you gave the instance of a video surveillance camera in a corner store. Okay. The general public sees that as a camera. I see it as a mechanism by which personal information is captured, which raises a whole bunch of other questions. How long is that information collected? Who might have access to that information? To whom might it be disclosed? What kind of technology is being used? Is it associated with facial recognition software and so on and so forth?
You have to drill down beneath the basic question about whether the surveillance is happening to find a whole range of very interesting and serious questions that any organization has to address, if it wants to capture personal information in that way. That, of course, is what the privacy legislation tries to get at. It does not say no, thou shalt not collect personal information. It says if you are going to collect personal information, you should be collecting it in a certain way to make sure there's a legitimate purpose and that the individuals about whom that information is collected have some rights associated with it.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
We're talking about the Personal Information Protection and Electronic Documents Act?
Political Science Professor, University of Victoria, As an Individual
Yes.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
In other words, regulating the private sector. To do that, I expect there are going to be groups that come and say to the private sector, you must do this, this, this, and this.
Have either of you philosophized on the concept of what that's going to cost business, either economically or in time? Should we care about that?
President, B.C. Freedom of Information and Privacy Association (FIPA)
I'm still thinking about your previous question. I want to distinguish between two kinds of surveillance, private and public surveillance.
When I go into a bank and it has cameras, I'm on its property, and it, in using those cameras, has legitimate use and would have to specify, of course, some of the questions Professor Bennett was concerned about: who gets to see it and how long it stays.
The public area concerns me a great deal, because there is endless talk about putting more video cameras in downtown areas of cities. Vancouver is talking about this endlessly. Leading up to the Olympics, we're going to have security issues. They're talking about putting them on Granville Street, the major north-south street in the city. The question here is, has this been sufficiently understood? Is there a cost-benefit analysis? Of course they have to prepare a cost- benefit analysis for the privacy commissioner of the province.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Sir, if I could interrupt, I understand we're taking about.... I mean, photo radar is popping up again, in Ontario at least, which may or may not be a good thing, but that's for someone else to debate.
My question is, are the regulations that we'd be suggesting to be put on private industry...? And you're right, I did confuse my examples, but let's zero in on the bank or the corner convenience store. They're the only ones I can think of; I'm sure you could think of dozens more.
I guess the cost to those particular businesses, not only economically in time, with respect to what they're going to be required to do.... Because the cost of business is one thing; protection of people's privacy is another thing. Surely you have to consider the cost to those businesses of demanding that they do certain things.
Have you put your thoughts to that, either of you?
Political Science Professor, University of Victoria, As an Individual
Yes. There is a good deal of analysis about the extent to which PIPEDA is costly in monetary and resource terms, etc.
My own view is that the costs of being privacy unfriendly far outweigh those. The costs of having a bad reputation in the marketplace, of being seen as unfriendly to privacy, far outweigh whatever compliance costs there would be in implementing proper security measures, or putting an opt-out box on a marketing form, or so on.
There are exceptions. There have been some companies that have had to invest a great deal into this. But by and large, most companies recognize the value of privacy.
Conservative
Political Science Professor, University of Victoria, As an Individual
There are plenty of examples, particularly with identity theft issues, where the stock of a particular company has plummetted as a result of bad publicity. It's difficult to quantify, and I don't have the information in front of me at the moment. I could certainly submit it to you. But businesses want to maintain good reputations, and privacy is a way for them to gain and maintain the trust of their customers.
Liberal
The Chair Liberal Tom Wappel
Thank you, Mr. Tilson.
If you have empirical evidence for your comments, we'd be very pleased to receive it, if you wouldn't mind.
Okay, we'll go to Madam Jennings, and then we have Mr. Stanton. If any other members want to ask questions, could you please raise your hands and catch the eye of the clerk, so he can write the names down?
Madam Jennings.
Liberal
Marlene Jennings Liberal Notre-Dame-de-Grâce—Lachine, QC
Thank you, Chair.
I'd like to come back to the issue of a distinction between the protection of personal information and the exemption of same when it comes to work product or professional information.
Mr. Bennett, you said that it would have to be very carefully crafted, in order to ensure that it doesn't become wide-ended. If you put your mind to it, would you be in a position to perhaps—maybe not today—suggest an actual definition that would allow for that distinction to be made, that exemption to be made, and at the same time ensure that it's not overly broad?
Mr. Rosenberg, in your brief you end with a number of recommendations. One of them is that the Privacy Commissioner should have the power to make orders. The British Columbia Civil Liberties Association recommended the power to render orders that could be tabled before the Federal Court and rendered immediately executory. I'm assuming that you're in agreement with that.
The other thing you raise in your brief is the issue of the lack of protection in the workplace for the personal information of employees, for whom that regulation or protection comes under federal jurisdiction. So in that case we're actually talking about in all the provinces and territories that have not brought in their own protection of personal information legislation, and that has been found to be similar to that of the federal and therefore we vacate that jurisdiction.
Do you have a preference...? You know the legislation better than I do the protections that already exist in B.C., Quebec, and Alberta. Do you think that one of those three models is better than the others, or are they pretty much similar in that protection? Because if this committee is going to look at the possibility of strengthening PIPEDA, in order to provide those clear protections, which do not exist, we would need some guidance on what models actually exist that in your view are good models to follow.
Following that, Mr. Bennett, would you like to add to this issue?
President, B.C. Freedom of Information and Privacy Association (FIPA)
I think the Alberta and B.C. are fairly—
Liberal
The Chair Liberal Tom Wappel
Excuse me, there is one question for Professor Bennett about a specific amendment, two questions for Mr. Rosenberg, and then a comment by Professor Bennett after Mr. Rosenberg.
Professor Bennett, could you address the first question?