Evidence of meeting #22 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Counsel, Public Interest Advocacy Centre
I'd like to add that we don't interpret the act in the same way as the commissioner does. We feel it is in the public interest to publish those names. It's just a difference of opinion.
Bloc
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Thank you very much and sorry for being late, it was beyond my control.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
Thank you, Mr. Chair.
Thank you all for coming.
I'm going to follow Mr. Tilson's line. I have to tell you, I get a little nervous. When we spoke to the Privacy Commissioner, my comment at that time was much along the lines of Mr. Tilson's questioning, that we're opening up a whole new bureaucracy.
I'll just give you my example. I was a car dealer before this. I was going to be a lawyer, then I became a car dealer, and now I'm a politician. You can see the regression in my life--at any stage. When this all came about, and when I spoke to my colleagues, we found this a bit terrifying. For instance, I have a staff of sales people. With the documentation we collect, if we sell a car and the other guy says that was his customer, the proof was the documentation. That whole process became an anxiety for a dealership. As Mr. Tilson says, if you're a fairly large dealership you can handle it, but a smaller dealership has to hire somebody.
I'm a little concerned, and maybe we can use the analogy of throwing the baby out with the bathwater. On the one hand, I hear some legitimate concerns, but on the other hand, I'm thinking, my goodness, if somebody wants to....
My wife loves to do the surveys. I can't understand why, but she loves that stuff. She hands these surveys out. She has enough sense when somebody calls, to say no, she doesn't want that. She likes the coupons, I guess, and all that other stuff.
But are we going way overboard for something that's so simple? I mean, for something as simple as notifying the public and saying, listen, I hope you realize that when you give this information you are opening yourself up to such and such, do we have to make new legislation?
I was quite comfortable after speaking to the commissioner that this was not the case, that they weren't zeroing in on small businesses that have no ill intent. But now I'm thinking, good Lord, we're going to get into whole new legislation. That is precisely--and I think I used the term--a reign of terror. Once we get these laws enacted, the government can just start persecuting small businesses. And really, there is no ill intent.
I would just throw that out to you.
Counsel, Public Interest Advocacy Centre
If, for example, the smaller businesses are holding personal information and they lose it, I'm assuming they would still be concerned for their customers. That's one of the reasons we brought the one big request here, which is that if they lose it could they please tell people.
Most small businesses are not using the personal information in a lot of secondary ways. They might be doing some mail-outs to their own customers, but they're not in the huge data brokerage industries. We don't see a lot that we're requesting here that's going to impact them any more than the act already does at the moment.
Conservative
Dave Van Kesteren Conservative Chatham-Kent—Essex, ON
But can't they police themselves? For instance, the insurance industry and the security industries probably do a lot of--
Executive Director, Canadian Internet Policy and Public Interest Clinic
Absolutely, and if businesses do, then there is not going to be any problem. What PIPEDA does is it takes an industry code of practice, developed by industry, and just turns it into legislation so that perhaps the minority of bad actors out there are also caught. The good guys are following their own codes of practice and doing the right thing--common sense, respecting their customers' privacy, not getting into trouble. The legislation is necessary to go after the other guys, the big data brokers who are just ignoring people's privacy. That's more what it's there for.
I can see how it seems really daunting when you don't know the legislation; it's new, and you suddenly feel, oh my God, I have to have a privacy policy, I have to be careful, I have to have all my records in locked cabinets, and that kind of thing. But I think when you go through it, most of it is actually just common sense. In this day and age, when we're suddenly now in an environment where information is so easily available and traded and lost and shared and abused, we just need to, all of us--and this act only applies to commercial activities, but I think there are other activities that we also need to be very careful about--make sure that our computers have passwords, encryption, or whatever, on them to protect the information.
You do need to make sure that if you decide to make secondary use of that information, let's say, in a car dealership.... I know you have my file there, and I know you might contact me in the future about something. I'm your customer, that's fine. But if you then want to sell it to someone else for some other purpose, then I want to have the option of saying no, and I think I should have it.
That's what PIPEDA does; it gives me that option.
December 6th, 2006 / 4:50 p.m.
Liberal
The Chair Liberal Tom Wappel
We'll have Mr. Peterson followed by Mr. Keddy, and that will be the end of round two.
Liberal
Jim Peterson Liberal Willowdale, ON
Ms. Lawson, your study of 64 online retailers showed that about half of them actually dispose of personal information to third parties, not necessarily affiliates, and that 78% of those people use opt-out methods for obtaining consent. Would you care to comment further on this?
Executive Director, Canadian Internet Policy and Public Interest Clinic
Yes. Opt-out consent is absolutely the standard in the marketing industry. It is allowed under PIPEDA.
Executive Director, Canadian Internet Policy and Public Interest Clinic
That's a very good question. It was asked earlier, I think, too. I think it's used in situations where it's inappropriate. I think you can do opt-out consent well if you give people proper notice, if you tell them up front, and if you bring it to their attention, effectively--
Liberal
Jim Peterson Liberal Willowdale, ON
We're going to sell your personal information to other people unless you tell us not to.
Executive Director, Canadian Internet Policy and Public Interest Clinic
I think opt-in is a much better approach, and I think organizations should be using opt-in. I think they're getting away with uninformed consent and consent that's not meaningful consent, because in many cases they're using opt-out and they're not doing it properly.
Liberal
Jim Peterson Liberal Willowdale, ON
The Privacy Commissioner says that you don't have to name people, that the threat of naming people gets them to comply. Do you have any comment on that?
Executive Director, Canadian Internet Policy and Public Interest Clinic
It doesn't seem to be working. I think the threat of order-making powers might help, but I think organizations are seeing right now a policy of not naming names, so they're feeling quite comfortable that they won't be named.
Liberal
Jim Peterson Liberal Willowdale, ON
Do you think there are fairly widespread breaches of PIPEDA right now?
Executive Director, Canadian Internet Policy and Public Interest Clinic
That's what we found in our study, yes.
Liberal
Jim Peterson Liberal Willowdale, ON
That's very interesting. We'll want to talk to the Privacy Commissioner about that and what to do about it.
What is the cost of a court case if I feel that I can't get justice from the Privacy Commissioner?
Counsel, Public Interest Advocacy Centre
We have one experience that's fairly detailed, the Englander v. Telus case. In that case, Mr. Englander lost at the trial division of the Federal Court and was ordered to pay, I believe, $15,000 in costs to Telus, and that didn't include his own time. He had to go to the Federal Court of Appeal, and he eventually got his costs back. But I'm assuming that he had more time on top of that. I don't know how many hours he spent on it, but if he was billing himself out at $200 an hour, that would be an awful lot. I know there's another case, which is detailed in our report, of a lady who had to abandon it because the costs were getting too high.
It's like any other court case; it's in the thousands.
Executive Director, Canadian Internet Policy and Public Interest Clinic
Tens of thousand.