Evidence of meeting #22 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Executive Director, Canadian Internet Policy and Public Interest Clinic
I don't think we've explicitly specified the penalty. It's something that needs to be further discussed, but we've said that should be subject to sanctions.
Our recommendation nine suggests that the offences section be expanded. On data breach notification, our recommendation is that there be tough penalties for that and not simply injunctive relief, which is appropriate for other kinds of problems.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
And you think that would be all right if you didn't have an appeal from those? I gather you're recommending what the other provinces have, no appeal.
Executive Director, Canadian Internet Policy and Public Interest Clinic
We have two different things here. We have the commissioner's orders and we have offences. Offences are prosecuted by the attorneys general.
December 6th, 2006 / 5:20 p.m.
Conservative
Executive Director, Canadian Internet Policy and Public Interest Clinic
They would be treated as different categories. Those are not orders that the commissioner makes.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Okay.
If we decide that we're not going to agree with you and that there shouldn't be order-making powers, and we continue on with the ombudsman model, what, if anything, should one do to improve that?
Executive Director, Canadian Internet Policy and Public Interest Clinic
Recommendations three to eleven in our submission are all about that.
Conservative
Executive Director, Canadian Internet Policy and Public Interest Clinic
I can quickly run through them.
Executive Director, Canadian Internet Policy and Public Interest Clinic
We're saying that there are lots of things you can do here to improve the situation.
You can make it easier for individuals to take cases to Federal Court, to get binding orders and damages where they have suffered damages. They should be protected from adverse cost awards in Federal Court unless they've behaved irresponsibly. They should be eligible for solicitor-client costs if they win. There should be the possibility for punitive damages, not just compensatory damages, in appropriate cases. Privacy breaches often don't carry much in the way of compensatory damages, and yet we would all agree that there's a behaviour here that should be punished.
We've talked about the publication of names. Permitting class actions is another important one. Right now only individual complainants can take their matters to Federal Court. They have to get a finding from the commissioner, and once they have that they can go to Federal Court. But often what we're talking about are breaches or violations of the act that affect thousands of individuals. The act should allow class actions in those situations. The Federal Court has rules for class actions that can be structured to permit those kinds of proceedings in appropriate cases.
The commissioner is doing a pretty good job of reporting statistics in her annual reports right now, but there's probably room for improvement. That should be mandatory in any case. It shouldn't be a discretionary thing. We need to know, particularly if she doesn't have order-making powers, more facts about what's going on.
We talked about audits, and we talked about expanding the offences section.
All of those things you can do without creating order-making powers.
Conservative
Gerald Keddy Conservative South Shore—St. Margaret's, NS
Thank you.
Again, it would seem to me that the request to appear here and to actually have some straightforward, fairly basic changes made to the law that protects consumers would be a responsible task for government to certainly look at and assess. I'm surprised that it hasn't already been done, quite frankly. I realize that maybe the act has only come into play in 2004, but you said it has been here since 2001. I'm just looking at some of the points, and I will repeat them, because I think they deserve to be on the record.
It's actually quite shocking that a large proportion of online retailers, one-half to two-thirds of your sample, share consumer information with other companies for purposes beyond those necessary for the transaction or service in question.
I can't imagine that people aren't absolutely up in arms over that.
Executive Director, Canadian Internet Policy and Public Interest Clinic
They don't know.
Counsel, Public Interest Advocacy Centre
There's a little bit of pushiness in principle 4.3.3 of the act that says it has to be for a legitimate and explicitly mentioned purposes, but we think that gives too much wiggle room, and we would prefer to have it amended so that it has to be information only requested for providing that service. That's why we said, here is a technical amendment, but we're shocked as well.
Conservative
Gerald Keddy Conservative South Shore—St. Margaret's, NS
Surely even if all of us are not up to speed on it, we all understand that we are in the information age, and information has value and you call sell lists. That's a value.
That's a value that's not taxed, in many instances. There's no record of it, but with most of those transactions, there's a whole economy that works around information and delivering information, and even around the protection of information. Obviously, if 78% of retailers rely on opt-out methods to obtain consumer consent to secondary uses or disclosure of their personal information, that's kind of a flagrant misuse of the law, as I understand it.
Executive Director, Canadian Internet Policy and Public Interest Clinic
I would say it's fine, it's perfectly legal, and it's okay if—if—they are getting proper consent. There are ways of doing proper opt-out consent, but our study shows they are not.
Conservative
Gerald Keddy Conservative South Shore—St. Margaret's, NS
That's certainly what's inferred in the statement.
Liberal
The Chair Liberal Tom Wappel
Mr. Keddy, it's 5:29. Do you have a short, final question that the witnesses could respond to?
Conservative
Gerald Keddy Conservative South Shore—St. Margaret's, NS
Yes, I do. I think you guys should have been here a long time ago, and this is something that should have been resolved a long time ago.
I have a good friend who had her identity stolen. She went through hell and high water to get it straightened out, and none of her debt was paid by anyone but her—not by any of the people who broke the law.
Executive Director, Canadian Internet Policy and Public Interest Clinic
The law is well behind the industry and the technology in this area, and it needs to catch up.
Conservative
Gerald Keddy Conservative South Shore—St. Margaret's, NS
It was years getting settled. It was unbelievable.
Anyway, thank you.
Liberal
The Chair Liberal Tom Wappel
Thank you very much.
The natives are restless. On behalf of the natives, I want to thank the witnesses, particularly for their specific recommendations. It is always very helpful, and we do appreciate that.
Thank you for your candid remarks and candid answers. We appreciate your coming and we'll do our best to do what we can to make the act better. I'm not sure about order-making powers, but we'll see.
Committee members, we'll be back on Monday. We'll have the Canadian Bar Association, Professor Kerr, and the Information Technology Association of Canada.
I'm sorry, Madame Lavallée, we're out of time.