Information & Ethics Committee on Nov. 27th, 2006

[Jennifer Stoddart]

Yes. Perhaps it's the same issue the assistant commissioner was giving some examples of. We then may require of those companies that may be sending your information outside the country that they hold those to whom they are sending it to Canadian standards so that this would not affect you in any more negative a way than were it completely treated in Canada.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

You have jurisdiction over those companies if they are outside of our borders?

[Jennifer Stoddart]

No. This is the hook and this is the interesting part of it. Through this mechanism, we have jurisdiction over the Canadian companies because it has a presence or a real and substantial link as the legal test in Canada. As you know, in the privacy world there are some countries that say their legislation has an extra-territorial reach, and on the other hand, Canadian law doesn't usually run except in Canada, and so on. The surest thing is the companies here are responsible for how they send the information out.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you.

[The Chair, Liberal, Tom Wappel]

We have Mr. Martin, followed by Mr. Dhaliwal and Mr. Tilson.

Mr. Martin.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you, Chair.

I was just reading a letter from the Assistant Deputy Minister of Industry pointing out that an organization in the U.K. ranked Canada's privacy regime as tied with Germany as the best in the world. I think that's something to be proud of. In contrast to that, or building off that point, I'm horrified at what I'm learning now as to what might be the real threats to privacy and the next generation of privacy issues, specifically the RFID information.

I only heard of this in the last few months. I don't think Canadians are aware of the idea that you can implant a chip in cards or in people and read it quite easily from a distance. Somebody asked how you would feel if the underwear you were wearing was helping to track your movements around the city. That's not inconceivable with this technology.

I'd ask you to speak to that and what your office is aware of, and what you can recommend to us to get on top of that next generation of technology. Is there any funded research going on, sponsored by the OPC on our RFID, and if not, should we not perhaps think of that?

[Jennifer Stoddart]

Yes. Could I ask the assistant commissioner to speak to the research that was done a couple of years ago?

[Pat Martin, NDP, Winnipeg Centre, MB]

Certainly.

[Heather Black]

I don't have the details at my fingertips, but yes, we did fund one of the universities. I think it was the Dalhousie Law School in conjunction with their computer engineering school. They came forward with a project on studying RFID.

[Pat Martin, NDP, Winnipeg Centre, MB]

What's the status of that study? Do you know, Ms. Black? Is it under way?

[Heather Black]

Oh no, it's completed. They did provide us with a paper on it.

[Pat Martin, NDP, Winnipeg Centre, MB]

Perhaps you could circulate that to the committee.

[Heather Black]

Absolutely.

[Pat Martin, NDP, Winnipeg Centre, MB]

I'd be very interested.

[Heather Black]

There is a fair amount of not so much disinformation as fear out there about RFIDs and what they're capable of doing. Right now there's limited use of them, but you're right, there's a whole great new world of RFIDs on its way in things like credit cards. There are some astounding instances. Apparently there was a bar in Barcelona, Spain, for example, that—

An RFID can be the size of a grain of rice, and you can have it embedded under your skin. It's scary to some of us, and other people say “Gee, what a great idea, because I don't have to carry my wallet and my ID and all that stuff. They scan it when I get a drink or whatever.” You have to face the issue that people are often willing to sacrifice a fair amount of privacy for convenience.

RFIDs in credit cards, for example, will probably bring us a new level of security with credit cards. They'll be maybe chip-enabled and have passwords and stuff like that.

We are working on RFID guidelines, which will be posted, I believe, on our website fairly soon, sometime this winter. There is information on RFIDs on the website of the Information and Privacy Commissioner of Ontario. There's a fair amount of information out there, but we will provide you with whatever we can.

[Pat Martin, NDP, Winnipeg Centre, MB]

Great. Thank you.

[The Chair, Liberal, Tom Wappel]

This hearing is being televised, and hopefully there will be some people who look at it. They may not know what an RFID is. Would you help them out?

[Heather Black]

An RFID is a radio frequency identification device. There are two types: active and passive. Some can only be read when they're put near a reader, and some actually emit a little signal.

I don't know if you buy books at Chapters, but occasionally a little square piece of paper will fall out of a Chapters book, and it has a little design thing in it. That's an RFID. If you fly via the airport in Hong Kong, your luggage is tracked by an RFID. They stick it on your luggage and they can track it through the airport. It's being used a lot at the wholesale level to track shipments of goods from the factory to the distributor.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

We will go to Mr. Dhaliwal.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

Thank you, Madam Commissioner and Assistant Commissioner.

This work product issue has come up again and again in these proceedings. Could you clearly explain the difference between work product and personal information when it comes to the medical field?

[Jennifer Stoddart]

In the medical field?

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

I mean in medical records.

[Jennifer Stoddart]

Well, personal information in medical records, let's say, would be the contents of my file, the medical details about me: my state of health, the results of my latest tests, things like these. This is all personal information related to me.

In the case where the Privacy Commissioner decided that some alleged personal information was in fact a work product, as I remember it had to with the prescribing patterns of doctors. So it wasn't personally about the doctor--himself or herself--like the contents of my medical file would be about me. Rather, it was the information about the doctor displayed through his or her professional activity.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

So you would call it a work-related product, then. Right?

[Jennifer Stoddart]

It was decided that it was not personal information.