Evidence of meeting #22 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
4:15 p.m.
Liberal
The Chair Liberal Tom Wappel
I congratulate you. You must have gotten 10 questions in there in seven minutes, and the answers.
We'll go to Monsieur Laforest.
4:15 p.m.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
Good afternoon to you all.
Since the beginning of the hearings, some subjects have come up often, including consent and the power to make orders.
With respect to the power to make orders, Ms. Lawson said earlier that the Alberta Act could serve as a model. When he was asked, the commissioner replied that it worked well in Alberta and British Columbia, but that it wasn't necessary to add an order-making power for the commissioner in the federal act. And yet a number of witnesses have told us that would be important, because it would toughen up the legislation and give the person enforcing it more power.
So we're hearing two contradictory versions. Your group's version leans a bit more toward grassroots public interest. How can you help us sort this out?
4:20 p.m.
Counsel, Public Interest Advocacy Centre
To begin with, in our experience, there have been organizations that didn't really follow the commissioner's recommendations. In those cases, particularly if the name of the organization is unknown, consumers will want to solve the problem themselves, by no longer dealing with the company or whomever.
I should also point out that in the provinces, for example, in British Columbia, an order is not made every time. The power is there to persuade companies that are a bit reticent to change their practices. I think it works well.
4:20 p.m.
Bloc
4:20 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
Yes.
I would add that we have trouble understanding why there is so much reluctance to adopt an order-making power at the federal level when it seems to be working very well in all three provinces, Quebec included, not just British Columbia and Alberta.
The reason we've pointed to the British Columbia and Alberta models is that they were modeled on PIPEDA three years afterwards. They got the advantage of seeing how the federal legislation was working and improving on it in a way that Quebec didn't, because Quebec was the first one out of the gate.
I have trouble understanding the opposition to order-making powers, because I think it's clearly proven to be a complementary tool in the hands of the provincial privacy commissioners.
4:20 p.m.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
With respect to consenting to the disclosure of personal information, one witness told us that it wasn't necessarily a problem of knowledge,but that it was more an issue of... It's as if the information or the rules weren't clear. I would say it's more a matter of making the rules better understood.
Do you agree with that, that it's more a matter of overall understanding than knowledge? Have you raised the problem of the need for more explicit consent?
4:20 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
I have a question of clarification. Are you asking about the businesses' understanding of their obligations under the act or about the consumers' understanding of the businesses' practices?
4:20 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
You're talking about consumers.
I would agree with what John stated, that the intention of this legislation is to ensure informed consent, which means the knowledge, the full knowledge of individuals about what the business is doing with their personal information. That is not stated clearly enough either in the legislation, speaking to the organizations, or in the organizations' privacy policies to consumers, in many cases. Businesses need to do a much better job conveying that to individuals, and the act needs to communicate better to the organizations.
4:20 p.m.
Bloc
Jean-Yves Laforest Bloc Saint-Maurice—Champlain, QC
It's a bit like using overly legalistic language to inform consumers. It's not that they're lacking information; it's that the information is hard to understand.
4:20 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
Yes.
We did scientific readability tests on the 61, I think it was, privacy policies we had overall. They all measured way above average. The average was way above average. I don't have it before me now, but on the scales we measured it, we did eight or ten different readability tests, and they were all above grade 13 comprehension levels, well above the standard English level.
Often these corporations are not communicating in plain language to individuals. The act requires them to do that. The act says it has to be generally understandable, it has to be reasonably easy for individuals to understand what's happening with their personal information. We had law students testing this, and they found—I gave you the percentages—in a large minority of cases what was going on was not clear to a law student.
4:25 p.m.
Liberal
The Chair Liberal Tom Wappel
I'm sorry, time is up.
Perhaps our witnesses could ponder the following, and then we'll go to Mr. Tilson.
Each of you has recommended order-making powers. The British Columbia commissioner was here, said he had his order-making powers, said he rarely if ever uses them, and—as I understood the evidence—supports the current Privacy Commissioner's lack of a call for order-making powers. The current Privacy Commissioner was the Privacy Commissioner for the Province of Quebec and had order-making powers when she was the commissioner for Quebec and now doesn't want them. I find that curious, given your unanimous recommendations.
I'm not asking for an answer, I'm asking you to ponder that while we go to other questions.
Mr. Tilson.
December 6th, 2006 / 4:25 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Thank you, Mr. Chairman.
I'd like to ask a question I've asked most of the witnesses who have come before us, and that has to do with small businesses. I've asked whether or not, with PIPEDA, small businesses are adequately looked after. In my community I'm thinking specifically of one business, a drycleaning business, but it could be a small mail order business in someone's home. There could be one or two individuals involved. We have a lot of those in our area. Almost all of you are talking about the contact with the corporation, or the privacy person with the corporation. For these people I'm referring to, there's no way in a million years they can afford to do all that stuff. Do they even have the resources to respond to some of the issues you're talking about or, indeed, what PIPEDA requires?
My question is getting a little long. I started off by saying to groups and, in fact, to the commissioner, are small businesses being looked after? Almost to a T, the answers have been “No, we could do a lot more”, or some vague answers such as that.
I wonder if all three groups could comment on that issue.
4:25 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
Thank you.
It's a good question. I think certainly more could be done in terms of educating small businesses and getting the word out about what they have to do under PIPEDA. I think there may be a perception out there that it's much more onerous than it actually is. PIPEDA does not require every organization to have a separate privacy officer. If it's a sole proprietorship, a small business, the guy in charge of privacy is the guy running the business.
4:25 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Mr. Chairman, I appreciate that, except that you're all talking about the issue of consent, or disclosing violations of the legislation. They won't know what in the world you're talking about.
4:25 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
And it probably won't ever affect them. This is largely directed toward businesses that are in the business of dealing with personal information.
4:25 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
I challenge you on that. If it's the one-person retailer who gets credit card information, they all say, “Oh, could I have your telephone number too, please?” or “Could I have your postal code?” And they all do that. Where does that information go? We all know where it goes.
4:25 p.m.
Executive Director, Canadian Internet Policy and Public Interest Clinic
This is the question. Why are they asking for that information? Do they really need to? If once they're getting into that business--
4:25 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
That's why I'm asking this question. You say PIPEDA isn't going to affect these people. Well, listening to your own answer, I think it is going to affect these people.
4:25 p.m.
Counsel, Public Interest Advocacy Centre
May I answer?
To the extent that it does affect the smaller businesses, we simply think it's good business, because if a customer finds out after the fact that there has been a loss of their personal data and it led to identity theft, that business would feel terrible and they would lose business in the long run. We think that it's good to get the issue in front of them--as Philippa said, an incentive--to have them take even a very general look at their data-handling practices, if you will, and put things under lock and key. They may think about maybe running a really simple encryption program. Even knowing what kind of information they have, it's not that onerous.
4:25 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
You know, sir, I understand what you're saying. But I go into my local drycleaner and I can still remember his talking about PIPEDA. He said this thing was killing him. He does know, people do know about certain requirements that the federal government has.
I don't want to spend a lot of time; I'm simply trying to make a general observation about how we are all talking about the big companies or big telemarketers, or whoever, but we're not talking about the little guy, and that's what I'm trying to get out of all witnesses. What recommendations do you have to inform the little guy? And also, little guys can break the law too.
4:25 p.m.
MRIA Standards Chair, Marketing Research and Intelligence Association
I share your frustration. Let's face it, the small convenience store operator won't necessarily have a written privacy policy that's posted, and all of these things that are required under the statute. Where I hope some organizations might attempt to assist the small business owner would be the various trade associations.
I don't know what the Canadian Federation of Independent Business has done for their members, but our industry association produced a privacy protection handbook. And recall that our association represents not only large corporate members but sole proprietors, focus group moderators, small business people. They have a comprehensive set of tools through their industry association that will help make it much easier for them to comply without incurring significant legal costs. I'd like to think that many other Canadian trade associations are helping their small business members to some degree.
4:30 p.m.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Most Canadians, I believe, haven't the slightest idea of what their privacy rights are. I believe that. I've listened to witnesses, and many witnesses have agreed to the same thing. The Privacy Commissioner has said—and it's an interesting philosophy—that we need to educate. We need to spend more time educating the general public as to what their rights are.
The Privacy Commissioner's budget is over $16 million. It's a lot of nickels. My question is, who should do that education? Should it be the government, the Privacy Commissioner, or should it be businesses?