Information & Ethics Committee on Nov. 29th, 2006

[David Tilson, Conservative, Dufferin—Caledon, ON]

I'm asking you, what should be the penalty if these are...? You've made a number of suggestions—

[Valerie Steeves]

Yes.

[David Tilson, Conservative, Dufferin—Caledon, ON]

—that there are violations of getting information from people, and that perhaps the government--you haven't said it, but you've implied it--should take some sort of action to stop that from taking place, either getting their consent or doing something. What if they don't do it? What should be the penalty?

[Valerie Steeves]

That's what we've got. That's the status quo. That's what the law does under PIPEDA. It says if you didn't get consent to get that information, then the commissioner can order you to stop doing the practice. You can try to conciliate with the parties to come up with a solution that suits. That's all in place.

[David Tilson, Conservative, Dufferin—Caledon, ON]

So there's a rule out that says that you—

[The Chair, Liberal, Tom Wappel]

Sorry, we're way over time.

Round two, we'll have Monsieur Thibault, Mr. Stanton, Monsieur Laforest, Mr. Wallace, and then Mr. Van Kesteren. That's round two, five minutes each.

Welcome to the committee, Monsieur Thibault.

[Robert Thibault, Liberal, West Nova, NS]

Merci.

Thank you both for appearing.

I understand your point about having this technology and a neutral type of approach, but there seems to be.... We talk about the Internet, but there are also cellphones and all these other technologies that are growing so quickly it's impossible to control. Even if you have all the companies, such as Microsoft and their move on pornography and all those things, there are still going to be ways to get around it. I think education on how to protect yourself becomes very important.

Just to make the point, I think we're going to have to consider the technology specifically, because it is going so fast. It's almost impossible to know when you're giving out the information. The consent mechanism isn't necessarily there. Sometimes they'll assume by the very fact that you are on that site that you are giving consent.

I went to the site of one of the large news organizations. I go there every day to check the price of oil on the commodities market. Before too long, I noticed I was getting unsolicited suggestions on stock picks. Included in that were some executable files. I delete everything, because I don't know what it is. I don't know if I ever gave consent for this. If I did, I didn't do it knowingly, but somehow it's there. There are a lot of difficulties with it.

I have a bit of a problem, generally, when we try to legislate these things, because these are from the consumer and commercial market. I don't like that my name and information is being sold because I bought a pair of headsets. They ask me for my phone number and these things in an electronic store. More and more you go there, and the first reaction is that you're filling in some personal information. Rather than just paying for your thing, they ask for this other information.

But there is the other side of it. There are things that I think are in the interest of society. The understanding of the laws and the application of the laws have become very difficult. I'll give the example of health care. It seems to me to be quite reasonable that when I go to a pharmacy he takes my social insurance number or some number and knows every drug that I've ever taken in my life--and that the doctor I visit has the same information. But not everybody agrees to that. Some information should be personal, and they don't want it floated out there. For the improvement of our health system, I'm willing to give up some privacy. I won't do it for commercial purposes.

To try to draft that regulation or that legislation in all provinces and all sectors and meet all those criteria becomes very difficult.

I wonder if you could comment on those points about the public interest and the individual's right to privacy.

[David Loukidelis]

Certainly.

Addressing the last point, about health care information and health privacy, there's a considerable investment now underway in creating pan-Canadian electronic health records. There is a challenge, of course, in ensuring that the privacy approaches in the various jurisdictions within Canada are brought into line.

There has been a considerable amount of work done. My federal colleague, Jennifer Stoddart, has worked with federal departments, for example, in creating an interpretive guide to PIPEDA in the health care setting. There's a federal-provincial-territorial harmonization framework on health privacy that is meant to promote harmonization so that the electronic health record initiative can move forward.

Difficult decisions are being taken across the country about the appropriate balance between the public interest in the sharing of personal information for health care delivery, to ensure innovation, research, and appropriate allocation of resources, and the private interest in one's health information. Where that balance lies I think is a dynamic balance, and not really my place to say.

I know in British Columbia certainly there are extensive discussions underway, and the government is being consulted on those. Among the issues being discussed is how technological tools can help individuals ensure that the most sensitive of their personal health information is directed only to those health care professionals who really need to know it for delivery of a particular service to that individual.

[The Chair, Liberal, Tom Wappel]

Professor, do you have a comment?

[Valerie Steeves]

As you know, you have an interesting mix of federal and provincial jurisdiction here. PIPEDA captures health information that is traded through the course of a commercial activity. The argument is made that information needs to flow within the health care community to ensure Canadians get the benefit of appropriate health care and all those types of things. At the same time, I think it's important to recognize that this information has an incredible value in the marketplace--it's worth a lot of money--and it's used for other purposes as well.

For example, I was contacted by a Canadian doctor who was sitting in his office when he got a knock on the door and a drug rep walked into his office and began going through his prescription records. He said he had a list of every woman in the doctor's practice between the ages of 35 and 55, and asked why they weren't on his drug for hormone replacement therapy. There's evidence that pharmaceuticals spend tens of millions of dollars a year to profile doctors solely to sell product.

When we create these infrastructures that allow the flow of information for the public interest, I think we have to be cognizant of the fact that there are secondary purposes and there are unintended consequences for that. When health information in particular flows out of the confidentiality, gets outside of that relationship between the doctor and the patient, all the evidence that I've been able to dig up in the research indicates that people respond by lying and hiding and not going to the doctor.

It goes back actually to a comment of yours, Madam Lavallée, about the importance of privacy as a social value and a human right. Privacy is more than the control of our information. It's how we negotiate the relationship between ourselves and others. It's central to our ability to trust other people, to enter into social relationships. When we allow that information to flow, if we don't respect the social value of privacy and the importance that privacy plays in the democratic process, we're going to end up with these unintended consequences and we will have people hiding and not going to the doctor because they'll only go if they know what they say to the doctor is confidential.

I think it's interesting that PIPEDA captures health information because it underlines that this is a commodity that's traded in the marketplace that's worth a heck of a lot of money. We have to be particularly careful when we examine those kinds of arguments that it should flow for the public interest because those unintended consequences aren't necessarily going to get you where you think you're going to end up.

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Stanton.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

To our witnesses today, thank you very much for attending this afternoon.

To Commissioner Loukidelis, on the question of the degree of remedy or response that PIPEDA currently provides, I understand in the B.C. format you have the ability to make orders and to force compliance with issues, which perhaps isn't available within PIPEDA. I wonder if you could relate the B.C. experience and comment on how things have played out compared with the ombudsman approach that the current federal act provides.

[David Loukidelis]

Thank you for the question.

I'm happy to relate the B.C. experience as briefly as I can. It's the only experience we know in British Columbia, beginning in 1993, with the enactment of the Freedom of Information and Protection of Privacy Act, which is the provincial public sector access to information and to privacy protection legislation. It covers over 2,000 public bodies in British Columbia. We've had an order-making power, and that is also the case, as you've said, under the Personal Information Protection Act. Since the beginning of 2004, we've had an order-making power.

However, it has to be emphasized that it is by no means the tool of first choice for our office, speaking for myself or indeed looking at the experience of our office. Looking again at the public sector experience, we always refer complaints about privacy issues or access to information appeals—and we have order-making power in that respect as well—to mediation by one of my colleagues. And we settle something like 88% to 91% of all those matters by mediation.

That's the approach that we're taking under PIPA as well. We refer complaints to mediation. In the three years, just about, that PIPA has been in force, I've issued seven binding orders under PIPA. The remainder of the matters we have been able to deal with in a mediation type of approach, which is consistent with the approach taken, as I understand it, in every important respect, here in Ottawa by my federal colleague and in other commissioners' offices across the country.

We have other tools as well. For example, we can refer would-be complainants back to the organization in question, which we do in many cases, to try to resolve the matter first, as a private matter, if you will. We also can refer individuals to other appropriate processes--for example, the grievance and arbitration process, if there's a collective agreement in place--which we do quite regularly, or to the human rights process as well. We sometimes refer them to mediation by private sector organizations, for example, as such chambers of commerce. And we also use our powers to educate consumers and organizations, as we've done in the public sector, and to produce supportive resources for them, guidance, if you will, on interpretation and application in a very practical sense, at least as best we can, to implementation of legislation, to try proactively to avoid complaints arising in the first instance.

So there's a whole array of tools, and the order-making power is far from the first one we reach for. In fact, in many respects, you could say it's the last tool we reach for.

[Bruce Stanton, Conservative, Simcoe North, ON]

To follow up on that to a degree, in the same light at the federal level, in a few instances the Privacy Commissioner has pursued the use of the Federal Court, which is the course of action available, but it's very much the minority of files. And they've used the investigations, the audit, the report approach to find and mediate these situations.

From your point of view, should we be looking much more closely at a great departure from this ombudsman model we currently have in place, based on your experience?

[David Loukidelis]

I'm obviously aware of my federal colleague's testimony on this issue to you earlier this week. It has worked well for us in British Columbia, given the nature of the organizations we deal with in the public sector, but also the nature of the organizations we deal with in the private sector. We have a much higher proportion of small and medium-sized enterprises in British Columbia than in the federal context, where you're dealing with banks, other large financial institutions that are federally regulated, such as telcos, where the ombudsman approach may have different benefits, if you will.

I agree with you that other tools are available to my federal colleague: recourse to the Federal Court, for example, and the audit power, which I understand she has started to use under PIPEDA, as well. So it's not as if the ombudsman approach is without sharper implements, if they're required.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Stanton.

Monsieur Laforest.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

Mr. Loukidelis, in B.C., you can make orders dealing with complaints. You said you had to make orders eight or nine times in the last few years.

Commissioner Stoddart said herself that it was not a priority in federal legislation, at least for her office, to ask for the power to make orders.

You talked to us about your own experience. You said you referred complaints to mediation and to someone else. Even if this is not included in legislation, doesn't the authority to make orders and find many kinds of other solutions reduce the number of complaints or at least improve the complaints review process?

[David Loukidelis]

It would be difficult to control whether or not you had the power. It's an impression. I can only offer you that. I don't think the fact that we have the power to make orders is likely to decrease the number of complaints we receive. In fact, I suppose you could argue the contrary: the fact that we can order an organization to stop doing something or to destroy personal information that it has inappropriately collected might encourage complainants to come forward.

Certainly almost all of the complaints we get, which vary in number from about 150 to 180 a year--the number is increasing, of course, as the legislation matures, and as people become more aware of it--we address through means less formal than reaching for the order-making power.

I suppose you could add that the possibility that an order would be made might concentrate the mind of the organization somewhat, but again there are other ways of ensuring compliance. Our experience has been that, generally speaking, organizations, once they're aware of their obligations under the legislation and once we discuss them with them, are more than willing to comply rather than having to go the formal route.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

This is exactly what I meant in my question. Basically, when you say that we shouldn't lose this power since this would eventually increase the number of complaints, I can put this in perspective.

But at the federal level, the Commissioner said she didn't need this power for the time being. However, if she had it, complaints could possibly decrease or at least companies and businesses could be persuaded, as you just said, to comply which would diminish the number of complaints. Companies would be more careful in the management of personal information.

[David Loukidelis]

I understand that the experience here, generally speaking, is that there is good compliance on the part of federally regulated organizations. Again, perhaps as the legislation becomes better known, and there's more and more experience with it.... Even if we didn't have the order-making power in British Columbia, we certainly would be using the same array of tools that were available federally to try to ensure that the compliance was consistent, and then, in fact, it would increase as the experience with the legislation moved forward.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

Thank you.

[The Chair, Liberal, Tom Wappel]

Thank you, sir.

Madame Lavallée, there's one minute left.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I'll just take a few seconds to ask you a basic question about fundamental rights.

You’re suggesting in one of your recommendations to make the protection of personal information a basic human right. Don't you think there are cases where some basic rights take precedence over others and that you should sometimes be able to get personal information from people against their own will?

I will very quickly give you an example concerning the Correctional Service of Canada. When officers of the Service are attacked by inmates and there is an exchange of bodily fluids, which is most of the time deliberate and vicious, the officers cannot access the inmates’ personal medical files.

Do you find this acceptable?

[Valerie Steeves]

First of all, privacy is recognized in Canada as a fundamental human right in a number of ways. Canada is signatory to international documents that underscore its commitment to the protection of privacy as a human right. The Canadian charter has been interpreted to include protection against unreasonable search and seizure where you have a reasonable expectation of privacy.

The fact that privacy is a human right doesn't mean that as a society we don't need to balance that right against competing rights. Freedom of speech isn't absolute in Canada; there are criminal limitations on what you can say. Privacy isn't absolute in Canada as well. There are a number of occasions where the courts, in particular in the criminal context, seek to find the right balance, when you have these situations where you have competing interests at play.

My argument is, if you recognize privacy as a fundamental right in PIPEDA, that what you're going to avoid is balancing that fundamental right against commercial profit or convenience. We don't balance off the right to freedom of speech because somebody could make some money if it were repressed. We come to situations where we have to decide where the limits are, when we're balancing right against right.

In the example you pointed to, there is a body of case law that has been developed to deal with that delicate balance. And it is a delicate balance; it is a difficult balance.

The suggestion I'm making is really drawing on the Finestone report, when the standing committee did an extensive public consultation on the impact of new technologies on privacy rights across the country. The recommendations of the standing committee at the time were that data protection legislation was necessary for the private sector, but they argued that data protection legislation will only fully protect privacy because of all the things we've discussed. It is a complicated environment, where information is flowing in all sorts of different ways, and our relationships are changing because of the platforms we're building.

Data protection will only be implemented in a way that gets us to where we want to be as a society if there is some umbrella commitment, some umbrella piece of legislation that recognizes that privacy is a fundamental value; it is a democratic value, a social value, a human right.

The suggestion of the Finestone committee was to enact a privacy rights charter that simply made that a statement of principle.