Evidence of meeting #19 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
Liberal
Jim Peterson Liberal Willowdale, ON
Yes. It would a substantial amount of time before you could get to court, be heard and be ruled on, wouldn't it?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
The statistics over the last five years show that, on the average, we have disposed of the complaints under PIPEDA in under a year. It's around eleven months, on an average. As you know, the time to go to Federal Court or the time before the Federal Court, of course, would then depend on how quickly both parties move, where the hearing is, and various other things like that.
Liberal
Jim Peterson Liberal Willowdale, ON
In your excellent memo to us, you say you don't want order-making power because you want to continue on the course you're on. This means, then, that you're probably happy with having to use courts to resolve certain issues.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Mr. Chairman, this is not the time to make any major changes in the framework of PIPEDA. As certain members of this committee will remember, this law was applied in less than ideal circumstances at the beginning. It has been a very difficult road for the Office of the Privacy Commissioner. That is one hand.
On the other hand, I don't think we have any really serious study about the advantages and disadvantages of various models of enforcement.
Thirdly, Mr. Chairman, I could say that we have quite a wide range of powers and that going to the Federal Court is in fact a very strong power, because an order of the Federal Court is an important order in the hierarchy of legal orders.
For all these reasons, I'm happy to go to Federal Court at the present time.
Liberal
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Again, I say, I don't know. I have nothing that leads me to believe that this is slower or more cumbersome than going before equivalent tribunals, and I have some knowledge of tribunals from having administered tribunals. It depends on the requests for stay of proceedings, it depends on the availability of parties, it depends on where they can be heard. So I think there aren't excessive delays at the Federal Court. I don't think we have to wait excessively long to be heard. Most of our cases are settled out of court.
In fact, if I can conclude on that, Mr. Chairman, when we, as we have in the last year or so, have in essence turned up the heat and said if you don't comply to our recommendations and come into conformity with the law we will take you to Federal Court, I think all organizations but one have complied.
Liberal
Liberal
The Chair Liberal Tom Wappel
Thank you, Mr. Peterson. You were right on seven minutes.
Madame Lavallée.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Thank you very much.
First of all, welcome. Thank you very much for coming to present us your suggestions on updating the act. You make a number of suggestions which are immensely interesting and you indeed point out the current issues.
One sentence of yours sticks in my mind:
[...] and the explosion of offshore processing, the amount of personal information flowing across borders has increased dramatically.
You also said — although I don't remember the exact wording — that there's currently no provision in the act for handling this confidential information. I'm not exactly citing your sentence; I don't know what paragraph it's in.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
As a result of the virtually global movement of personal information, that volume wasn't anticipated when the act was drafted in 1998. I don't have a clear directive in the act for dealing with my counterparts to solve potential problems. I'd like a change so that the act would give me a general scale to determine whether it's in the public interest to go and talk about even the details of a complaint brought before me with a counterpart in the European Union, for example, whether it's in the interest of Canadians' privacy.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Okay.
Currently, I imagine you have activities, meetings, conversations with people in the European Union or the United States. Don't you?
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
You already do. Then you have the... However, am I to understand that you want to go further in dealing and negotiating with them?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We're trying as much as possible to address only very general areas, so as not to give out a person's personal information, for example.
However, we'd like some clarification. For example, in a complaint concerning an individual, where it's preferable that that complaint be addressed by our French counterparts, we'd like them to be able, in an entirely legal way, to have the individual's personal information as well. I'd like to clarify that.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
I only want to be certain I understand. Pardon me, but I'm new to this committee. I haven't been examining this act for very long. So I want to make sure I clearly understand what you're saying.
In the case of a complaint, for example, you'd like to be able to deal with your counterparts in the European Union so that you could investigate the complaint together. Is that correct?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, that's it.
For example, we want to be able to simply send our counterparts a copy of the complaint including all the personal information of the person in question, telling them that they can find a remedy for our complainant here in Canada.
The act isn't clear on this point; it doesn't specify whether I can do that. I haven't done it to date. I stick to general information.
How could we reinforce the actions on both sides?
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Okay.
I find that interesting, but I must admit that's not what I understood. That's not how I had interpreted your problems or concerns. I thought they focused more on the general way of protecting personal information of Quebeckers and Canadians where that information, for one reason or another, must circulate internationally. I thought that that was more your concern.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Okay. That's another of our concerns. We say that in a brief. That's a question that has been the subject of a number of discussions. You'll no doubt hear a number of views on that question.
In our opinion, it's possible to include in the act general scales like those the Canadian government has included in the directives recently issued by the Treasury Board for the public sector. However, one of the principles of the act, the accountability principle, is also designed to encourage the businesses that export the personal information of Canadians to submit the other outside businesses or organizations to Canadian standards.
We're telling you that this is a major problem. We mention various approaches, and we add that, if you don't intervene, there is, in any case, a fairly strong and flexible principle, the accountability principle.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
All right. To address this problem, you'd simply need additional measures in the act. Is that what you're telling me?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We can already address this problem under the accountability principle.
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Privacy Commissioner, Office of the Privacy Commissioner of Canada
No, I think it's principle no. 4.
Bloc
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes. These are the principles of the code. This act was designed on the basis of a standard of the code of Canadian standards. The Privacy Code is related to and forms an integral part of the act. The first principle of the act is the accountability principle.
Even if I'm a Canadian organization that sends personal information on Canadians outside the country, I'm still responsible for it here in Canada.