Information & Ethics Committee on Dec. 6th, 2006

[John Lawford]

I believe the Privacy Commissioner has the mandate, under the act, to do some public education, and we do acknowledge that they have some guidelines on their website. I'm not sure of their plan for reaching out in the future. I believe it was referred to in the last report that they were going to put something more in place. I believe we can count on them for some of that, but I do like the suggestion that there may be alternate routes to getting the message out there. Certainly from consumer organizations' point of view, we're happy to work with the business organizations to do that.

[David Tilson, Conservative, Dufferin—Caledon, ON]

So you think it should be a combination of both, that both the business organizations and the commissioner should participate. How would business organizations do that?

[John Lawford]

I'm just going to take a stab in the dark here, but I know the Privacy Commissioner does meet with the business organizations on a fairly regular basis, and this is something that certainly could come up in discussions with them at that time. We would be happy to participate, as well, to the extent that would exist.

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Tilson.

We start our five-minute rounds, and I'll start off.

Ms. Lawson, you said the act has been around five years, so why hasn't everybody complied? We heard, I believe, that in fact it's only been around fully for about two years—January 1, 2004, isn't that right?—so why do you say five, and I think you gentlemen said six?

[Philippa Lawson]

It's six years.

The act came into force on January 1, 2001, and everyone knew about it then. The provincially regulated businesses were given three years' grace period, basically, before it became effective for them. So they had that first three years to think about it and get educated and get ready for it, and then it's been an additional two years since then that they've been under the legislation, subject to the legislation. So there's a distinction for some businesses between just the legislation being there but their not being subject to it, and their being subject to it.

[The Chair, Liberal, Tom Wappel]

I believe it was the Canadian Marketing Association that said that for them it came into force on January 1, 2004. I think that's what they said.

[Philippa Lawson]

That's not true. For many of the members of the Canadian Marketing Association, it's been effective since 2001. For some of their members it's only been effective since January 1, 2004, but it's been around since 2001, and they all knew about it.

[The Chair, Liberal, Tom Wappel]

Okay.

Mr. Lawford, you said the respondents' names should be published.

[John Lawford]

Yes.

[The Chair, Liberal, Tom Wappel]

What about requesters whose requests have been deemed to be frivolous or who have asked for information for what is determined by the Privacy Commissioner not to be a valid reason, validly requested, and it costs the company a lot of money? Should their names be published?

[John Lawford]

No, we don't think so.

[The Chair, Liberal, Tom Wappel]

Why?

[John Lawford]

Because privacy is personal to the individual, and that further publication of their name will, in their view, also victimize them from a privacy point of view. It's special that way, and we do acknowledge that is a special situation, because we're dealing with personal privacy.

[The Chair, Liberal, Tom Wappel]

Even if the requests were frivolous and vexatious?

[John Lawford]

Even if their requests were frivolous and vexatious, because we don't think there are a lot of those complaints, and that in situations like that—

[The Chair, Liberal, Tom Wappel]

That may be.

[John Lawford]

—there are still routes for the company in the court system, if they feel they are being attacked in an unfair way, to try to address that.

[The Chair, Liberal, Tom Wappel]

Okay.

On this naming names, if you feel that a particular—and not this one, but a particular—Privacy Commissioner is reluctant to use what they already have, section 20, etc., what makes you think they'll be any less reluctant to use order-making powers?

[John Lawford]

That's a fine question. If there's an organization that is being investigated further than just mediation, if it's a resistant organization, let's say, I'm sure the Privacy Commissioner will come across situations where they get no response from the company, where they have had an egregious situation, and in those cases the Privacy Commissioner will want to get an order out there. For repeat offences, I think at that point the Privacy Commissioner will see the value in laying down the law, if I can put it that way, to someone who has ignored the last two findings. Those will be the situations where it will start to happen.

[The Chair, Liberal, Tom Wappel]

Finally, if there's only been zero to one name named, how does one know whether or not businesses are ignoring the Privacy Commissioner?

[John Lawford]

We have determined, through very careful reading of the rather cryptic findings--a number of examples are in our report--that in at least three cases there are repeat offences for the same bank, because the commissioner at the time said it was the same bank as in finding number x. I can give you the exact numbering if you give me one moment.

[The Chair, Liberal, Tom Wappel]

No, I'm just curious. If it's all so secret, then how do we know that people are specifically going against the Privacy Commissioner?

[John Lawford]

There may be more. We found three.

[The Chair, Liberal, Tom Wappel]

But you think it's a bank, or you know it's a bank?

[John Lawford]

I have two cases with banks.