Evidence of meeting #22 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Executive Director, Canadian Internet Policy and Public Interest Clinic
There was one case where we made a complaint against the company, and it was the third time. It had been complained about twice before, and you could determine that.
Liberal
Conservative
Mike Wallace Conservative Burlington, ON
Thank you, Mr. Chairman.
And thank you for coming this afternoon. I have a couple of questions in my five minutes.
I want to ask one directly, right away, and it's on the Canadian Internet policy piece. Your 11th recommendation is to remove the “reasonable grounds” requirement for audits. Does that mean it's unreasonable grounds? What do you mean by that? Being a lawyer, you should be able to answer this question, I guess.
I don't know why you don't think there should be reasonable grounds before we start doing audits.
Executive Director, Canadian Internet Policy and Public Interest Clinic
Well, I think it's fine. I think it's a good idea to have reasonable grounds. I think there is a place, however, for spot audits, like randomized spot checks, if the commissioner has the resources to do that, where it doesn't have to be a company against which there have been several complaints. That's one reason.
Another reason is that it seems to be...I mean, the commissioner's being taken to court right now by Equifax for not having reasonable grounds for a particular audit when apparently there were four complaints and a preliminary investigation. It just seems like a tremendous waste of resources to allow that kind of litigation when the Privacy Commissioner is extremely unlikely to engage in that kind of audit without reasonable grounds in any case.
Conservative
Mike Wallace Conservative Burlington, ON
Right. Well, I would agree with you they're likely to have reasonable grounds to go in, and I think in your view or your organization's view, maybe they could do spot audits. Would you not agree, though, that they'll probably require more funds from the taxpayer to make that happen?
Executive Director, Canadian Internet Policy and Public Interest Clinic
I'm not sure. The money they're getting right now, $16 million, is a pretty decent amount of money. I don't have the ability to judge what you can do with that.
Conservative
Mike Wallace Conservative Burlington, ON
Okay.
On the consent issue...no, let me go to the naming issue first. I have an issue with naming.
I don't understand why there's an issue, if the commissioner can resolve the problems without the publicity of someone being named. Isn't the whole theory to try to protect people's privacy and not to try to embarrass people because they screwed up?
Executive Director, Canadian Internet Policy and Public Interest Clinic
There are a number of complaints that are disputes between one individual and one company, and those absolutely are appropriately dealt with through mediation, resolved and settled, and no one's name needs to be published in those cases necessarily.
But there are many more, certainly the complaints that CIPPIC has lodged with the Privacy Commissioner, that have to do with company policies and practices that are widespread and are affecting thousands and thousands of consumers at once. It's not a question of a dispute that you can mediate. This is a matter where in many cases companies are just blatantly, in our view, violating the law and they think they're right. The issue needs to resolved, and it's an issue that should be resolved publicly, in our view.
December 6th, 2006 / 4:40 p.m.
Conservative
Mike Wallace Conservative Burlington, ON
Okay, so do you believe their name should be announced prior to their being found guilty--and I use that word loosely--of violating the act?
Executive Director, Canadian Internet Policy and Public Interest Clinic
No, I think the release of the corporate name should be after the findings have been made.
Conservative
Mike Wallace Conservative Burlington, ON
Okay. Another question I have for you is on education. We've had some dispute...and I actually agree with a couple of Mr. Wappel's questions. He stole a couple of mine.
On the piece on education, we've heard from some groups that it may have been in place since 2001, in time to get you ready for it, and it took effect in 2004, and so on. But would you agree that the government or the commission has not done a great job in terms of bringing people up to speed on what needs to be done here? I know they've come to see us during budgetary discussions, and some of the new money they're looking for, additional money or whatever it is, is to be geared to education.
I'll be frank. I was involved in municipal council for 13 years, active in business for 20-some years since graduating from university, and since I've been here, it's the first time I've heard of it.
Does anybody want to take a shot at answering that question?
Counsel, Public Interest Advocacy Centre
I have to agree with you that I don't think enough outreach and enough education has been done from a consumer point of view.
Conservative
Mike Wallace Conservative Burlington, ON
So don't you think we're premature in making these major...?
I'll be frank with you. I'm listening to what the commissioner wants to do, first, because they're dealing with it on a daily basis. On the issue, for example, of order-making powers, I'm having a hard time saying, well, this individual who deals with it on a daily basis is saying we need more time with it to see what's happening; and you're using other examples, of course, that are happening. But I need compelling reasons why that person who deals with it on a daily basis isn't giving me the right answer.
Counsel, Public Interest Advocacy Centre
The two aren't incompatible, because you have cases that we found over the last four or five years where some companies are just never going to give in. They will continue the practice. But it's true that a huge amount of education still needs to be done, especially at the consumer end, to say that you have these rights, and at the business end, to say these are your responsibilities and this is how to handle it. I don't see the two as being incompatible.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
First of all, I'd like to finish up with the question my colleague asked earlier, and then I'll ask my own questions.
Shouldn't the act provide for an explicit consent form?
Counsel, Public Interest Advocacy Centre
At the Public Interest Advocacy Centre, PIAC, we suggested a form that is already in the Quebec legislation. The court decisions are really along the same lines, but it's not explicit.
So we support that kind of amendment.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Okay, great. Thank you.
My other question has to do with publishing the names of companies that I would call delinquent. On the one hand, it's clear that the debate is largely focused on the fact that consumers are lacking information on the protection of their personal information. People are always under the impression that they will be protected, or on the contrary, sometimes there are people who are a bit more paranoid and are sure that everyone is distributing their personal information.
On the other hand, when companies are delinquent, their name is not disclosed. Personally, I really have a hard time understanding this fact. I know of no other legislation under which the names of delinquents are not made public, apart from pedophilia cases. I don't understand that.
What's more, you just said the names of delinquent companies shouldn't be disclosed. And yet an organization like yours appears to be interested in defending consumers.
Maybe I missed something. Could you clarify that?
Counsel, Public Interest Advocacy Centre
I think we said exactly the opposite. What we said was that at the very least, the names of delinquent companies should absolutely be published, as well as the names of the people responsible. As for the commissioner's other decisions, the names of companies should also be disclosed, where appropriate.
Executive Director, Canadian Internet Policy and Public Interest Clinic
I know that for many years PIAC and also CIPPIC have been calling for the naming of organizations that have been found delinquent under the act.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
How is it that in this legislation, companies have had the privilege of remaining anonymous? Do you know any other legislation like that?
Executive Director, Canadian Internet Policy and Public Interest Clinic
The Competition Act is similar.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
The Competition Act.
I am so surprised by that. I'm also surprised to see that other groups, other witnesses have come here... Perhaps we could hear from the people sitting beside you.
Do you think we shouldn't go right ahead and publish the names of delinquent companies?
MRIA Standards Chair, Marketing Research and Intelligence Association
I think businesses that are flagrant abusers and violators of privacy rights should have their names published. Publishing the names would shame them into compliance, one would hope. They would become media stories, and then that would sort of tie into the question raised previously: how do you increase awareness and consumer education?
If people can be cloaked in anonymity, then yes, of course consumers aren't going to understand their privacy rights and the law. So this is one way of bringing their rights to their attention. Name names. Let's not treat offending organizations with kid gloves.
