Evidence of meeting #19 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
Good afternoon, madam, and welcome.
Toward the end of your presentation, you told us that it was possible to improve the act and you made a few suggestions. However, some witnesses have told us that the fact that your office or you yourself don't have the power to make orders slightly complicates the process for them following an investigation.
When you compare that somewhat with the power that the commissioners have in Alberta and British Columbia, this is a process that could help. You said that you didn't intend to seek additional powers. I have trouble understanding why you say the time isn't right.
Is it only the time that isn't right?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
You referred to Alberta and British Columbia, but that's also the case in Quebec.
To answer your question, I'd say that the time is very important. I believe we haven't really had the opportunity to implement this act as we should have done, let's say, until April 1 of this year, when we had granted a budget commensurate with our tasks and had an office stable enough and an implementation plan that had been thought out in advance, that was coherent and that reflected the needs of both parties, etc. Before, it was somewhat erratic. This is an office that has experienced a number of disruptions.
That said, we have extremely broad powers. I told your colleagues that, with one exception, all the businesses that we told that we didn't agree with their interpretation of the act, that we believed that the complaint was founded and that they should take this or that remedial measure, reacted well. When we said that we wanted to go to court and that a Federal Court judge would make a decision, all those businesses complied with our requests, except one, for the moment, and we haven't thoroughly argued the case.
I also have a power to conduct audits. As you've no doubt seen in the papers, one company is disputing our power to conduct audits through the judicial review process. This is an enormous power. We can seek remedies for damages, and we can seek remedial measures.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We can seek remedial measures before the Federal Court.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, in a Federal Court judgment.
The purpose of the act is to settle complaints. I think the purpose of an act isn't, in itself, to make orders. The purpose of the act and of the machinery that administers it is to ensure compliance. If you take a close look — which few people have done — at current compliance with this act regarding the complaints process, you'll see that it's very great, except for a few judgments such as in the Blood Tribe judgment, for example.
I don't think the problem is the way complaints are handled. I don't think it's less efficient than what you see before the courts. I administered a tribunal in Quebec, so I think I'm talking in full knowledge of the facts. Before the courts, there may be enormous legal complications. It's not as quick as we'd like. The problem isn't the handling of complaints received. The problem is everything that happens that isn't subject to a complaint. I think that's the major issue.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
So the fact that you don't necessarily want new powers immediately in this regard isn't just attributable to the time, which, as you say must be considered as important. It's also very much a matter of substance because, ultimately, you're saying that you think the powers you already have are quite sufficient. Later, you might possibly see whether other powers would be necessary.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
That's correct. I think I have broad enough powers. I haven't had the time... I haven't been commissioner for a long time, and you know that the first years of my term were devoted to restoring the office, but I have very great powers under this act. Give me a little more time to exercise them, and you'll see in five years whether that was effective or not.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
That's perfect. That's a very good answer to my questions. Thank you.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Thank you, Mr. Chair.
Thank you for coming here again.
I've got to say that when you and I first spoke about your job, Madam Commissioner, it certainly was an enlightenment on a personal basis, because I was the owner of a small business prior to this, and I've got to tell you that it struck terror into all our hearts when the mandate came down.
When I listen to the testimony, it appears to me that you don't really have a heavy-handed approach unless there's cause or unless there's violation. Am I correct in assuming that?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes. The law is flexible. It's a fairly light law, but if there is a complaint, we investigate that complaint until there is a settlement or we say it's not founded. We're not letting people at this point just.... We're not saying it's well founded and then walking away. Sometimes I read that the Privacy Commissioner said something is well founded, and then nothing happens. Well, that may have been true in the past; for over a year now, if it's well founded, then we are ready to go to court to hold up our interpretation of the law. We've had virtually total compliance on this--but it's very few cases, honourable member, so in that sense, it's—
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Somebody has to initiate a complaint, first of all.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
That's right.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
I think my colleague was alluding to that in his prior question.
As you move forward, have you thought about portraying that message? Again, I'm thinking about the small business person looking at the mountain of paperwork and these new tasks being put in front of him. Maybe we could convey to him that this is what we don't want you to do--you've got to fall into these guidelines so that you don't break the law, you don't offend and, as somebody said, violate somebody's privacy. Is that something you're possibly going to consider at the next stage, so that the smaller business owner understands? I really don't think they understood, as I didn't, the true nature of the legislation.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, Mr. Chairman, the honourable member is completely right. On January 1, 2004, some amazing misinterpretations of PIPEDA were circulating, and I think there was a sense of panic. Of course, a lot of that was the fact that the office had been in such upheaval and hadn't done what ideally it would have done, although it did consult with small business.
Yes, we have identified small business as a very important target for public education. I must say that I don't think a heavy hand should be brought to small business on this kind of issue. We have major players; most of our personal information is with the major players in this organization. I would certainly concentrate my attention on them first.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
As I said, once the objective was made clear, then it all made sense. I think most people would fall into the same category I was in.
Do you have inspectors out in the field and checking for compliance?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
No, we don't have inspectors. We have auditors—
Privacy Commissioner, Office of the Privacy Commissioner of Canada
—but we have to have reasonable grounds to believe there's a problem; we have to have noticed something. We have two cases in which we've sent in our auditors, but this was not small business, I may say.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Probably the biggest concern--and I think Mr. Martin alluded to that as well--occurs when a corporation is in a takeover, and that crosses borders. When you have those takeovers and you really don't know what's going to happen to that information, is that your biggest area of concern?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
That has to do with being able to share personal information in the case of a sale. Is that what you're referring to?
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Any information, anything that could be used, like Mr. Martin said, for your health.... If, for instance, you had to buy life insurance and my life insurance company was transferred to another country, they could make it difficult for me to buy auto insurance or something like that. Is that an area of concern?
