Evidence of meeting #20 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Department of Criminology, University of Ottawa, As an Individual
Okay. I went to Bell Canada and I bought a phone and my phone number somehow got into the hands of somebody who is sending me text messages. I get about 30 a day, and they're junk messages, but I pay $1.25 for the privilege every time I get one of these junk messages. I have no idea who has my information. I have no idea how they got it and I need some mechanism that allows me to go to a corporation and say I need to know this so I can make a decision about whether I want to get these messages or not.
PIPEDA will get us there as long as you have a chance to look at tightening up the language. Give it a shot. It will work.
Liberal
The Chair Liberal Tom Wappel
Okay, thank you.
Commissioner, I'll give you an opportunity to answer any of the four, particularly any comments on surveying children.
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
If I can address the—
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
If I could address the question of cookies first, consistent with what I said earlier, I would not suggest that, again in the B.C. context, we take a technologically oriented approach to these things. I think general principles of privacy legislation should continue to be the order of the day. When it comes to cookies specifically, there are tools in your Internet browser, for example, and there are third-party pieces of software that you can often get for free on the Internet that will allow you to exercise an incredible degree of control over cookies. For exmple, you can choose to accept or reject cookies, as you see fit, and to allow yourself to be tracked as you surf across the Internet or not.
On the question of surveying children, clearly that introduces some very sensitive issues around the ability of youth to understand what it is they're entering into when they give up some of this information, sufficiently so that in the U.S., Congress passed the Children's Online Privacy Protection Act of 1998. Again, it is early days for these laws in Canada. For my part, I would hope that in British Columbia, we can, only three years into our law, continue to work with industry to try to ensure that in the case of children and generally in relation to some of these technological challenges, those general principles are adhered to and that the legislation works well in its present form without radically altering the approach to some of these technologies.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Thank you, Mr. Chairman.
Commissioner Loukidelis, I appreciated your comments about the “work product information”. That has been discussed in the committee. You may be reluctant to get into this, but Commissioner Stoddart gave evidence to the committee that the national commission looks at each matter on a case-by-case basis, as opposed to a specific definition. I don't recall, but I don't think she really said that we should have a definition. Can you talk about that--the specific definition versus what the federal government is doing, looking at matters on a case-by-case basis?
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
Sure.
As I mentioned, in British Columbia's law we have a definition of “work product information”, and clearly the legislature, using specific language, has given me direction. It's my obligation, on a case-by-case basis, if the matter actually comes to me in a formal inquiry, to interpret and apply those words as intended by the legislature.
Having said that, if we didn't have that definition, and if in fact we were to fall back on a definition of “personal information”, which is “information about an identifiable individual”, you would still have the same opening that has been taken here by my federal colleagues and in other provinces under their public sector legislation to try to interpret what information is “about” an individual in the sense intended by the legislature, and perhaps coming to the same result that has to be said.
November 29th, 2006 / 4:15 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Except, I suppose by not having a definition, case B could be quite different from case A, even though they're almost identical.
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
There would nonetheless be some play at the margins. It's the old struggle between specificity and generality in legislative drafting. I think, though, if you have a decision that clearly sets out the principles for interpreting what is meant by “information about an identifiable individual”, you could come ultimately to the same result, subject to a different view being taken by the courts.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
On the business transaction issue that you talked about, corporations or businesses selling their business to someone else, I'm just wondering how much the state should interfere in that. For most transactions or most sales of businesses, that non-competition clause and that non-disclosure clause are routine clauses in almost any of the agreements I've ever heard of. If people choose not to have that, is the state interfering too much in personal business transactions?
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I would characterize the special provisions in British Columbia's law dealing with business transactions as enabling or facilitating business transactions, by relieving businesses primarily of the obligation that would otherwise apply, to go back in each instance of a sale of a business or a substantial portion of a business and get consent from individual consumers, employees, customers, shareholders, senior management, and so on. It in fact relieves them of the consent obligation and tries to appropriately facilitate change of control, sale of assets.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
I'm just saying that's generally done anyway, as opposed to the state mandating it.
Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I think the concern would be, under British Columbia's PIPA, that you can't disclose personal information without the consent of the individual. Now, it's true that at the time--and this is going to the point you've made--you collected the information from your customer you could, in a notification to them, which is required under the legislation, say, and by the way, in addition to using this information in order to sell products or services to you, we may disclose it for the purposes of a business transaction, but I think some certainty was sought by the legislature, including that particular set of provisions.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
On this business of a survey, Ms. Steeves, my only observation is that somewhere along the line we've got to take control of our own actions. My God, normally, with children in particular, when there are phone calls that come in and people ask what do mommy and daddy do, you train your children not to give that information out. In fact, normally you say don't take cookies from strange men who are walking along the street. Normally you say, with respect to whether it's on the Internet or whether it's on the phone, don't give out that information. In fact, you tell your spouse don't give out that information, because God knows where it's going to get out.
When you're out at a fall fair and you sign your name to a lucky draw that gives you something, there's always a price for that. Who knows where your name's going to get out?
And I guess it's the same question I'm asking to Mr. Loukidelis: somewhere along the line, can the state go too far in interfering in people's lives? It may mean that the whole process, which Commissioner Stoddart has talked about, and to a certain degree I'd agree with her, is the issue of education. There's a price to pay for giving out this information, as opposed to saying thou shalt not do it.
Department of Criminology, University of Ottawa, As an Individual
The legislation is set up to use consent as a mechanism, to allow people to make those choices. One of the problems with this is that people often release the information in a social situation, not realizing that it has commercial consequences.
I do a lot of privacy education for a K-13 kind of age range. I've written a number of multimedia games designed to teach kids to protect their privacy in cyberspace, and in the real world, and all that type of thing. I cannot agree with you more about the importance of education and public discussion on these issues.
At the same time, I think we have to recognize that these kinds of invasive practices are being embedded into social environments where people don't realize that there is a cost to pay. When I was talking to my—
Conservative
David Tilson Conservative Dufferin—Caledon, ON
If I could interrupt, let's say you pass a law that says you can't do that, whether it's for children or adults or anything. How are you going to enforce that?
Department of Criminology, University of Ottawa, As an Individual
I'm a bit bemused, because right now we have a law that says if you want to do it, ask, tell me, and then I can make a fair decision about it.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
What if they don't? What if you have a guideline or a policy or a law that says you can't do surveys to children or whatever--to adults, for that matter? I have a lot of problems with saying people can't take surveys. If you don't want to do a survey, you don't participate. I'm asked to do surveys all the time. Most of the time I say I'm not going to do them.
Department of Criminology, University of Ottawa, As an Individual
We do have a law, and the law says if you want the information, ask for it. And if somebody gets this information from my children then I have procedural rights under the data protection legislation, under PIPEDA, that I can enforce. So I can go to the Privacy Commissioner's office. I can lay a complaint. There can be an investigation. The practices can be looked at to make sure that they conform to that basic principle.
Department of Criminology, University of Ottawa, As an Individual
We have penalties under the legislation now.