Evidence of meeting #19 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
There is an anti-spam task force, but—
4:50 p.m.
Liberal
The Chair Liberal Tom Wappel
You're at five minutes.
Madam Commissioner, to follow up on Mr. Tilson, you said: “I would ask you to consider a specific provision to make it clearer we”—I presume the commissioner—“have the authority to share information with our international counterparts while cooperating on investigations of mutual interest”.
That's what you're asking for, to share information. Is personal information of Canadians what you mean? And you want to be able to share it with international counterparts? Am I reading that correctly?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes. And I would like to share it not only on cases that are of mutual interest, but on cases where it would be in the interest of Canadians that the investigation of the redress be followed up in another jurisdiction.
4:55 p.m.
Liberal
Marlene Jennings Liberal Notre-Dame-de-Grâce—Lachine, QC
Thank you.
I'd like to come back to the question that my colleague Mr. Dhaliwal raised about aggregated prescribing information and the possible necessity for a carve-out and a clearly defined exemption.
Due to medical advances we have an increasing number of drug therapies to treat all kinds of health conditions. We have medical practitioners who require scientific information about the impact of certain prescribing profiles. We have researchers who also require this kind of information.
Do you not think it is possible to do a very clear carve-out that would provide an exemption for aggregated prescribing information that would not affect the fears you have of weakening privacy protection for personal information if a definition of “work product ” is done, because that would make it so large as to weaken that protection? Is that something you think could be considered?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
If the honourable member has a specific type of work product information in mind, it would doubtless be possible. I was replying in a generic way for all kinds of work product information. I believe you mentioned prescription patterns. That could probably--I'm saying probably because I haven't done the exercise--be specifically carved out. Then it would be fairly clear that it wouldn't spill over into the other issues of workplace surveillance that I'm concerned about.
4:55 p.m.
Liberal
Marlene Jennings Liberal Notre-Dame-de-Grâce—Lachine, QC
Thank you. I would appreciate it if you would look at that and possibly propose an actual carve-out for that specific type of work product information. But it would be specifically aggregated prescribing information.
The other point I want to get back to is the CSA standard as a model. We've heard from expert witnesses that it's actually a good model because it's a fairly light-handed model that provides a building block from the bottom up. However, when we come to the issue of consent and the definition of consent, studies have shown that a significant number of companies imply consent, and the way they obtain consent may not be as clear to the consumer as one would hope. These organizations are recommending that the whole issue of consent be tightened up so it has to be a proactive thing, rather than implied.
I'll give you an example. I received in the mail an application for a credit card saying I had been pre-approved for a $25,000 credit limit--simply sign it off. But there was a whole section on privacy. I scratched it out and wrote by hand that I consented to the use of my personal information solely for the purpose of obtaining the credit card. I did it as an exercise.
The company sent me back an application three times. So it was clear that they wanted to use my information for more than just issuing me a credit card. That's implied consent. I think it should be tightened up, but I'd like to hear from you on that.
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Consent, of course, is at the heart of the protection of privacy. As you say, the problem of tightening it up goes to the challenge of trying to provide a basic definition of all the contexts in which you give consent. That would be quite a challenge, and I would not be able to suggest how you would say in such and such situations it's expressed consent and in other situations and so on. In enumerating them, we have provided guidance, we have suggested the level of consent. We have many conclusions on this, that the more sensitive the information, the more express the consent would be. We've gone into the issues of what a reasonable person would consider appropriate in consent in the circumstances.
It is not an issue for the law to be tightened up, but for compliance work. This can be. If you had made a complaint, for example, that would have allowed us to go into the current practice. Why is that company coming back again and again? We may have seen them already, or we have never seen them. It would be a chance, an open door, but everybody doesn't have time to make complaints to the Privacy Commissioner; that's the problem.
5 p.m.
Liberal
Marlene Jennings Liberal Notre-Dame-de-Grâce—Lachine, QC
Next time I get that and I cross it out and put my express and limited consent, if I get another application, I'll send it to you with a complaint.
5 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Okay. We'd be happy to have it. Because one thing we have done, as I remember—I think the assistant commissioner remembers the details of this—is we have said very clearly to organizations that when consumers say no, they don't want to receive things and they don't want to be on mailing lists, you have to respect their wishes. You can't go on and on and batter them into finally receiving the material you want them to.
I don't know if you want to hear about those cases. We had several cases on that.
5 p.m.
Assistant Commissioner (PIPEDA), Office of the Privacy Commissioner of Canada
As you know, the code says specifically that you can object to the collection, use, or disclosure of any personal information that's not required to provide you with the service. In the case of the credit card, what information do they need, how do they need to use it, to whom does it need to be disclosed to provide you with the credit card? When it goes beyond that, when they say when you sign up here we're going to market you, or we're going to release your name to third parties they think you might want to hear from, maybe I don't want to hear from them.
It is covered in the law, so it's a question of educating organizations. And the thing they need to be reminded of constantly is listen to your customer. What does your customer want?
November 27th, 2006 / 5 p.m.
Conservative
Lynne Yelich Conservative Blackstrap, SK
My concern as a consumer or as a client is that I wonder what I'm signing, what authority I'm giving to people. For instance, the dentist wanted me to sign something. They just said sign here, it's really nothing, just this new Privacy Act that's out there. I said I didn't mind signing it but asked what they were going to do with the information. I don't care if I get extra mail; that isn't what's bothering me. But what are they going to do with it?
So I wonder how much I am giving them, and you've more or less answered that. I still don't know. I guess it's the individual circumstance.
You said there were 56,000 complaints and inquiries. What's the background of those? Is there a certain sector that has more inquiries in your office than others? I just want to get into perspective what it is that your office is really addressing.
Thirdly, because I don't want to come back, in my riding I had a car dealership that immediately was very upset. Everybody thinks car dealers are rich, but they find it difficult because these people have to hire somebody else to do the databasing. Maybe they're overreacting, which is going to be my question. Are they overreacting? They want to database not only the customer, but whether that customer chose a particular colour of car or if they took it for a test drive. They're trying to database all of that information. Perhaps their dealership is overreacting, so I just want to know if it's something that sounds unreasonable when they say they have to hire somebody just to database all this extra information that they require from a customer. Of course, when you're dealing with cars, you probably are trying to get them on a mailing list to entice them to buy cars.
5:05 p.m.
Assistant Commissioner (PIPEDA), Office of the Privacy Commissioner of Canada
Maybe they're overcollecting.
5:05 p.m.
Conservative
Lynne Yelich Conservative Blackstrap, SK
I would say they are, but this was actually a directive from their parent company. So I just wondered about that. I actually had a letter from them—perhaps I should get that letter to you—describing just how cumbersome it was and the fact they had to protect themselves. That's how paranoid they are.
I think you're right. The level of communication is quite low in terms of understanding what you have to do to protect yourself from anyone who might take you to court.
So to go back to the 56,000, I'm just curious, and then I will—
5:05 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't have the breakdown here about those inquiries—
5:05 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
—but most of the complaints are against financial institutions, because they are regulated by the federal government. How many bank accounts do we all have on average? The number is probably four or five per Canadian. There are all the mortgages and all the amounts of personal information that go around financial institutions, including credit card companies. That is the first major sector.
We then have insurance companies, again because they handle a lot of personal information. We have transportation, because the federal government regulates transportation. In particular, airline transportation requires a lot of personal information. And there's telecommunications. Once again, that brings us into phone companies and cable companies and so on, which again are increasingly linked up with other suppliers. That's basically the picture.
5:05 p.m.
Conservative
Lynne Yelich Conservative Blackstrap, SK
Thank you very much.
I want to go back to my first question. Is there such a thing as reverse onus or burden of proof? If I signed something and then found out I wasn't happy that they used my name in something, could I lay a charge against that company if I really didn't think they.... Would the burden of proof lie with me?
5:05 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
In making a complaint, yes. I would say you can, but I'll let the assistant commissioner explain.
5:05 p.m.
Assistant Commissioner (PIPEDA), Office of the Privacy Commissioner of Canada
If you've signed something and then you change your mind, you have the right to withdraw your consent.
5:05 p.m.
Assistant Commissioner (PIPEDA), Office of the Privacy Commissioner of Canada
Quite often, organizations don't listen to someone who tries to withdraw consent. They may explain to you that they can no longer provide you with the service if you withdraw consent, but in a lot of cases—say, for third-party marketing or something like that—you can withdraw your consent, and if they don't listen to you, then by all means complain.
5:05 p.m.
Conservative
Lynne Yelich Conservative Blackstrap, SK
I was just wondering, because sometimes you don't know what you've signed until the basics of it come to mind.
Thank you very much.
5:05 p.m.
Liberal
The Chair Liberal Tom Wappel
I have just a couple of questions, if I may.
One of the roles of the Privacy Commissioner under PIPEDA is education and information, as it is under the Privacy Act. I heard a startling statement at last Wednesday's meeting made by Mr. Richard Rosenberg, president of the British Columbia Freedom of Information and Privacy Association. I want to quote it for you and ask for your comments:
Second, a much more effective education function is required. The OPC could serve a more effective role than it has up to now; namely, to bring the office and its role under PIPEDA to the attention of the Canadian public. In my classes and talks I have rarely found anyone who knows about Canada's privacy law, his or her rights under the law, or the existence of the OPC, the current Privacy Commissioner, or the activities of the office. A survey commissioned by the Office of the Privacy Commissioner in March of this year showed that something like 8% of Canadians had heard of PIPEDA. Clearly, if you're not aware of laws protecting you, it's going to be hard to take advantage of the protection they provide.
I'd like to give you the opportunity to respond.