Information & Ethics Committee on Dec. 4th, 2006

[Bruce Stanton, Conservative, Simcoe North, ON]

I'm sorry, Mr. Brazier. I appreciate the clarification, but I also have one question for Mr. Gustavson and I only have five minutes.

[Don Brazier]

I'm sorry.

[Bruce Stanton, Conservative, Simcoe North, ON]

I appreciate it.

Mr. Gustavson, we heard a statement from a previous witness, and you alluded to it earlier in your remarks, that PIPEDA was essentially an amalgamation of interests both from the privacy community and from commercial interests. The act effectively became very much a compromise between those two.

If I recall, and I'm really paraphrasing here, the witness essentially suggested it was in fact an inherent weakness in PIPEDA. Could you comment on that type of remark from one of the witnesses we had?

[John Gustavson]

I think it's what the Attorney General called “a remarkable national consensus”.

Somewhat to my surprise, during the process of negotiations I learned that privacy advocates are generally not out to shut down business; they're not out to harm the economy. I hope they understand, and I believe they learned through the process, that business respects privacy and that good privacy practices support consumer confidence in doing business with you and are good for business.

I take quite the opposite view. I think the strength of PIPEDA is in the fact that people came together and learned from each other to create a document we could agree on. The 10 principles that apply no matter what the situation is, no matter what the technologies are, and no matter what the evolution of media is, are going to stand us in good stead for a long time.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you.

[Barbara Robins, Vice-President, Legal and Regulatory Affairs, Reader's Digest, Canadian Marketing Association]

I absolutely echo that. That's its strength, not its weakness.

As we're sitting here today, I can tell you that our beautiful piece of law will probably be the model adopted by Singapore. As we speak, it's being looked at by the South African Law Reform Commission, and it's being looked at by many governments and many legislative bodies that are looking for a balanced law.

That's its strength, not its weakness. It's not a compromise; it's a balance.

[Bruce Stanton, Conservative, Simcoe North, ON]

That's helpful. Thank you very much.

Thank you, Mr. Chair.

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Stanton.

Monsieur Laforest.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

I am returning to the brief of Federally Regulated Employers - Transportation and Communications, or FETCO. You made 14 recommendations and said at the outset that some of those are more important than others. Mr. Peterson mentioned earlier your recommendation number eleven. You recommend that employers be exempt from fulfilling requests for information that are frivolous or vexatious.

How do you define the terms “frivolous“ and “vexatious“? Could you provide any examples? Supposing your recommendation is accepted, how can we ensure that the employer will not interpret those terms in a subjective way?

[Barbara Mittleman]

Thank you.

[Don Brazier]

Go ahead, Barbara, everybody wants to answer.

[Barbara Mittleman]

There will obviously be some subjectivity in the employer's response. An employee, as Edith has said, who makes the same request 50 times and the employer says, look, I've searched everywhere and I don't have this letter that you claim to say exists, or I don't have this document that you claim exists—

We've actually experienced situations like that, where we've made an honest effort and whatever the employee was looking for just wasn't there. It didn't happen. So in a case like that, the employee will file a complaint and the check and balance is that the Privacy Commissioner will investigate, and when they look into it, they'll either find that, yes, lo and behold, it was there and being hidden, or in fact the employee is requesting this thing 50 times and it doesn't exist.

For example, you may have a situation where a union is in the midst of collective bargaining and says, guess what, I think this'll be fun, let's get 50 employees to go and make requests for their files in the next....You have 30 days to respond. I have one privacy person in charge of managing this. Let's just do this as a method of wreaking some havoc, I don't really want the personal information. So there could be things like that.

So the employer, yes, has to make a subjective call, but it is subject to supervision.

[Edith Cody-Rice]

There have been cases before the courts where a decision ended up being made that the request was frivolous, but you have to go quite far into the process set out in the act before a request is ruled frivolous. I should tell you that we have had a case where a person who was no longer an employee made a request every three months for information that did not exist. Every three months, she made a new request where she asked for the same thing. At some point, obviously, she lodged a complaint with the privacy commissioner who confirmed that the object of her request did not exist, that it was a frivolous request. A request cannot be considered frivolous the first time, nor probably the second or third time, but after ten or twelve times, it becomes frivolous, I believe.

[Jean-Yves Laforest, Bloc, Saint-Maurice—Champlain, QC]

Good answer, Madame.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Do I still have time left?

[The Chair, Liberal, Tom Wappel]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I would like to follow up, Mr. Brazier, on your recommendation about the consent of employees for the use of their personal information. I need some examples, I need to understand in what context an employee is asked to sign a consent allowing his employer to access his personal information.

[Don Brazier]

Maybe I can just reiterate the comments I made in answer to basically what was the same question, and that is that we're talking solely about management of the human resource system. We're not talking about anything broader.

I think the specific question was something like, with the employee, does this mean you could take personal employee information and give it to a subsidiary and use it for marketing purposes? Obviously not, because as I indicated, this is strictly for employee relations purposes.

I think we've given examples. There are a number of examples in the back of the brief. For example, there are employees refusing to give their employee number at a hotel where the hotel requires it so the hotel can charge the rental of the room to the employer. It's hard to imagine an employee refusing that, but these are the kinds of things that come up.

I'll just go on with that example. If the connecting device between the employer and the hotel where the employee is staying is the employee's number, then we don't think it's unreasonable that we can provide it to the hotel so that when the hotel charges the room to the employer we know who the employee is.

This may sound kind of trivial, but that's the kind of example, and there are many of those types of examples I could use.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I thought that the consent you had in mind was a consent to be given at the time when the employee first joins the company. The employer says he has personal information on file about the employee and requests the employee to sign a form allowing this information to be used. Does such a process exist?

[Edith Cody-Rice]

It exists in our corporation. We have a consent clause in our commencement form. But some candidates refuse to sign it and we cannot hire them because we cannot communicate to the government their social insurance number or other similar information. This consent clause is included in the hiring form, but what purpose does it serve? The consent is mandatory because we cannot hire anybody without using this information. So why ask for consent? Why do we not have the ability to use some pieces of information for employment purposes without having to ask for consent? It would be enough to tell the employee how we are going to use this information.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I have not seen—

[The Chair, Liberal, Tom Wappel]

Excuse me.

We're out of time, and we do have other questioners, so I have to be fair to them.

We'll go to Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Merci beaucoup.

I want to ask a few questions. I appreciate your coming today.

We've been sitting here for a few weeks looking at this piece, and I just want to be clear. From the two organizations we have here today.... I'll be frank. My first impression is that maybe we're too early in looking at this. I know it's the law, but the vast majority have come without a whole lot of change.

Could you just reiterate for me--I'm sorry, I was out of the room for the first part of your presentation--whether your organization believes that we're on the right track in terms of timing? Or is there a suggestion in terms of how long it should take, or should there be an extension before we do a proper review of the piece?

We'll start with you, Don.

[Don Brazier]

Somebody must have decided that five years was an appropriate time to have a review. We're also involved in the five-year review of the Employment Equity Act, which is another five-year period of time. Is that an appropriate time, is it 10, or is it 15?

[Mike Wallace, Conservative, Burlington, ON]

I guess the question is whether, as organizations, you have had enough experience with it. Or do you think you need more?