Evidence of meeting #19 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
4:45 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
Would you have any difficulty, then, incorporating that into PIPEDA?
4:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
As I said, it's always easier to define things in a particular fact context. You mentioned that this issue came up again and again. It doesn't come up very often in our complaints. I don't know how many complaints we've had that would deal with that--perhaps a handful. This is not an issue that dominates our complaints.
One issue that does come up a lot in our complaints, and one area where we have active concern, is about the use RFIDs or other ways of surveilling people in workplace surveillance. Those of us who work for anybody are going to be subjected to increasing surveillance.
So yes, you could put a definition in the act. We're just cautioning you that any definition may have this indirect effect, with new forms of technological surveillance coming, of providing less protection for workers.
4:45 p.m.
Liberal
The Chair Liberal Tom Wappel
I wonder if you'd be kind enough, Commissioner, when you come back, to give us a concrete example of what you're talking about. I'm having a great deal of difficulty making the leap between what Mr. Dhaliwal was talking about--the prescribing habits of doctors--and how, if there were a definition in the act, that would somehow impact on the privacy of employees in a washroom in a factory. Perhaps you could help us out by giving us some concrete example of how the one follows the other.
While it may not be a major one of the 1,400 complaints you've received, it has been brought up by virtually every witness, and I believe it will be brought up by other witnesses. Clearly it's of some concern to some businesses out there, and they'll be looking to us to make some kind of recommendation. If you could help me and the committee with how you figure the one has anything to do with the other, that would be a great service to us.
Mr. Dhaliwal.
4:45 p.m.
Liberal
Sukh Dhaliwal Liberal Newton—North Delta, BC
Further, Chair, most of that information these days is used for research and development purposes.
Take the information on, for example, the prescribing pattern of doctors, how they prescribe medicine. If the information is used for research purposes, would it still fall under personal information? If it's for business purposes, would it fall under PIPEDA?
4:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
It's at the time the information is generated with the organizations that it's qualified. It's the circumstance in which it's generated that leads to the definition. Afterwards, for example, it may be anonymized, and then it isn't personal information for various points.
We'll come up with an example, Mr. Chair.
4:45 p.m.
Liberal
The Chair Liberal Tom Wappel
Thank you very much.
On that point, you mentioned that the Privacy Commissioner had made a ruling. Are you bound by that ruling? As the new Privacy Commissioner, could you change it? And even if you confirmed it, it's my understanding that it's not binding on the Federal Court, whereas a definition in statute clearly would be.
4:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
You're right that the ombudsman's conclusions are not binding on Federal Court. Certainly as an ombudsman one has a certain amount of latitude in conclusions, but as I think one of the honourable members said, it's always a good idea to provide predictability. We try as much as possible to provide a continuous line of reasoning in our conclusions.
4:45 p.m.
Liberal
The Chair Liberal Tom Wappel
Just to be clear, you could overrule a previous commissioner if you so chose.
4:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Technically, yes, I could. It's not binding, really, on anybody. It's an opinion.
4:45 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Thank you, Mr. Chairman.
One of my colleagues, I think Madame Lavallée, asked a question on the issue of transferring a file to another jurisdiction. Your response was that you could indeed transfer a file to another jurisdiction.
I'd like you to talk a little bit about that. Are you telling me that you could conceivably transfer a file to one of the European states, or to the United States? Is that what you meant by that?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Do you mean that I could, as Privacy Commissioner?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
No, I don't think I can now.
4:50 p.m.
Conservative
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Well, that's what we think, although in the consultation, it's interesting that many people responded that the Privacy Commissioner should do whatever is in the public interest, and they would take a generous view of this.
I don't see that it's clear in the law, and in fact, I would think the law says the contrary: that I can't transfer a file to the EU, for example.
I'm saying that in the state of the world, I think I should be able to, if the circumstance warrants it. The Federal Trade Commission is currently asking for the same kind of powers, because it's very hard to follow the data trail now.
4:50 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Would you have a definition as to the circumstances in which you would do that? It gets back to the issue of the earlier question I asked on personal information. In other words, you look at everything on a case by case basis. I suppose the same would apply, and you'd look case by case at situations as to whether or not you could transfer a file to another jurisdiction.
I would think that, to serve the best interests of the country, we'd want a specific definition, if you were to do it. Quite frankly, I don't see how you could do it, because you'd be breaking the law.
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't do it, honourable member.
4:50 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
I must have misinterpreted what you said. You thought there might be circumstances when you could transfer a file?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Perhaps I wasn't clear. There may be circumstances—in fact, one could think now that there are circumstances—where it would be very useful for me, as Privacy Commissioner, to be able to transfer a file to a similar organization in another jurisdiction under wording—because you asked for wording, honourable member—something like “for a complete and satisfactory resolution of the case”, with the consent of the individual, of course.
If I said, basically, “You've been a victim of some organizations in the United States”, and I'll use some cases that are well known, and in fact part of this is before the Federal Court, “but in order to really get some redress, it would be better if the American authorities took up your case”, as police investigators do—they'll transfer it and go after it under their own laws—the Americans then could go—
4:50 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Except that we're all very proud of our own sovereignty, our own jurisdiction, and not assigning our laws to any other country, or our proposals, whether it be in privacy or police work; we're going to look after—
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We are very proud of it, but that pride does not give us the legal right to, for example, investigate in the United States or act as the police. It's in cases where I couldn't act, which is in most other jurisdictions. I would say, could you take this over? And vice versa, if they had somebody who was coming against their personal information, they would transfer it to me.
Data protection authorities across the world are looking at this. Some European ones already have the powers, because they're in closer contact than we are. The Federal Trade Commission has a series of amendments before Congress called the SAFE WEB Act that would allow them to do that for those reasons, because Americans' information is everywhere.
4:50 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Mr. Chairman, I have a question with respect to electronic payment crime, which is on the increase. In 2004 the federal government announced the creation of something called the “cyber services task force”. Do you know what that is?
4:50 p.m.
Conservative