Evidence of meeting #23 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
4:35 p.m.
Some hon. members
Agreed.
4:35 p.m.
Liberal
The Chair Liberal Tom Wappel
Okay. Thank you.
We now go on to the second round, which is for five minutes each. We have Mr. Peterson, Mr. Wallace, Mr. Van Kesteren, and Mr. Stanton at the present time. Should anyone else want to, just put up your hands.
December 11th, 2006 / 4:35 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
Following up on Mr. Tilson's questioning about order-making power, one of the complaints I imagine is, is it going to Federal Court? It's very costly and time-consuming. It's an intimidating thing for an individual to have to do.
Having said that, what about looking at a tribunal that could...? You'd give the commissioner order-making power and then you would allow a tribunal to decide, and it would be more of an informal tribunal, as the Canadian Bar Association has suggested.
Mr. Courtois.
4:35 p.m.
President and Chief Executive Officer, Information Technology Association of Canada
I would feel uneasy about that. I think the brunt of what people see going on and the statistics quoted by Professor Kerr show there really isn't a problem. I would hesitate to say we're going to legislate another regulatory body just because we think we might be able to improve things.
This isn't broken, and it does not require more regulation and another regulatory tribunal.
4:35 p.m.
Canada Research Chair in Ethics, Law and Technology, University of Ottawa, As an Individual
I would like to go on the record as saying there's more than one way to interpret what those statistics say with respect to whether there is a problem or not. That should be obvious to the members, but I want to go on the record as saying that.
4:35 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
Part of our submission, and the reason for suggesting the tribunal, was based on what we see as a potential conflict between the competing responsibilities of the commissioner's office. When you think about it, the commissioner's office is responsible for educating, for investigating, for helping mediate, but also for acting essentially as the judge. So that conflict and our recognition of that is reflected in our suggestion for this tribunal.
4:35 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
People would have to have a lawyer if they're going to a tribunal, wouldn't they?
4:35 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
I don't think so. I'm not looking for new work.
4:40 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
Our suggestion is an informal tribunal, so it is just that; you wouldn't have to go to court. Currently, you have to go to court and you have to wait up to a year to get a recommendation from the commissioner's office. So I don't think the current framework is helping those--
4:40 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
Taking the Federal Court out of it and having this less awesome tribunal--no appeals to the Federal Court--was Mr. Tilson's question.
4:40 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
That's not our recommendation. Ultimately, the Federal Court could weigh in.
4:40 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
So for a “deep pockets” organization you'd go to mediation, then you'd go to the tribunal, and then you'd go to the Federal Court?
You've all dealt with three different provincial laws and you've also dealt with the federal. What did you learn in terms of what the best law is in looking at all four jurisdictions? Are the suggestions for change based on one of these systems being better than the others? And where's the lack of harmonization?
4:40 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
The bar mentioned the lack of harmonization, so let me start with that one. Then the next one would be what are your recommendations flowing from these?
4:40 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
Sure. The short answer is that there was a preference for some of the provincial acts, notably Alberta and British Columbia.
I'm flipping to my business transaction section, and that is a good example of where the provincial laws have learned from the PIPEDA experience. The drafters learned from the deficiencies and the lack of clarity in PIPEDA, specifically dealing with due diligence investigations in the sale of a business and a recognition that lack of clarity in PIPEDA is not assisting business. It's not assisting with the protection of privacy or the facilitation of--
4:40 p.m.
Liberal
Jim Peterson Liberal Willowdale, ON
These are the areas where you want better definitions, as in the appendix?
4:40 p.m.
Chair, National Privacy and Access Law Section, Canadian Bar Association
Yes, and with the business transactions, without referencing them, the B.C. and the Alberta legislation in particular set out expressly what organizations are to do to protect privacy.
For instance, if you're going to sell your business and you want a prospective purchaser to take a look at your personal information holding, right now it is unclear when and how they can view that, if at all, under PIPEDA. The Alberta privacy legislation spells it out. And for organizations that don't have deep pockets, that makes it a lot more business-friendly, so they don't have to retain people like me.
4:40 p.m.
Conservative
Mike Wallace Conservative Burlington, ON
Thank you, Mr. Chairman.
Thank you for the presentations tonight.
I have a few questions. We've heard a lot about this organization and this legislation in the last few weeks.
Following up on Mr. Peterson's question, and it was one of my questions for the Information Technology Association of Canada, you indicated that you think the present system on order-making powers is fine. Since you are a Canadian organization, and I believe there are order-making powers in British Columbia, for example, have your members had an issue with that? Would you like to expand on that a little bit?
4:40 p.m.
President and Chief Executive Officer, Information Technology Association of Canada
I would say we have no indication that where there's an order-making power, there's better implementation of privacy protection. In other words, the ombudsman process is simpler and more straightforward for both complainants and the companies involved, and it seems to be producing good results. I've not had anything that says the B.C. situation produces better privacy protection--maybe a little more work for lawyers, I suppose. The way we get feedback, not just from the statistics but from our members, is that once you get an investigation by the Privacy Commissioner, all the pressures are there for you to change your behaviour.
4:40 p.m.
Conservative
Mike Wallace Conservative Burlington, ON
Just so I have a better understanding, who are your members?
4:40 p.m.
President and Chief Executive Officer, Information Technology Association of Canada
About 70% of our members are small companies and 30% are larger companies, 70% Canadian-based. It's a very international industry, maybe about 30% multinationals—not the same overlap, because there are some Canadian-based multinationals. They're involved in computers, all kinds of computer technology, mobile technology, telecommunications technology, software, information technology services, and consulting. There are a lot of very small software companies, a lot of small companies. Canada, for example, is a world leader in security software and that kind of—
4:45 p.m.
Conservative
Mike Wallace Conservative Burlington, ON
Has there been an increase in cost due to the introduction of PIPEDA?
4:45 p.m.
President and Chief Executive Officer, Information Technology Association of Canada
Yes, at first, in the sense of trying to adapt to a new law, to create processes in the firm to respond to it. But they do not begrudge that, because as I said, this is an industry whose very livelihood is dependent on good privacy protection. Except that once you go through a whole process of education—and as I said, there are two layers. There's self-regulation, where the businesses themselves have to learn about this, get educated, and comply. That's where I get a little leery about changes to the law that would require them to study everything again.
After a few years, we're still in the process of getting all this to filter through and getting people comfortable with what they have to do. And technology changes so much that they have to keep up to speed on that as well. So they've got plenty on their plate with that already.