Evidence of meeting #23 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
President and Chief Executive Officer, Information Technology Association of Canada
We haven't addressed this issue either. Mr. Kerr's comments seem reasonable, but that is no reason to add special powers in the legislation. I have nothing more to add.
Bloc
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
The answers are interesting.
Do I have any time left?
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Thank you.
You know, you're the first ones who have raised this issue. The solicitor–client privilege issue hasn't really been raised since the commissioner was here. Most of you, if not all of you, are lawyers. I always thought that lawyers would get terribly excited on that topic. Solicitor–client privilege is a big deal, and she's recommending that it change.
Ms. Siegel, what do you think?
Lawyer, Information Technology Association of Canada
I can't imagine why the treatment of documents in an investigation would be different for the Privacy Commissioner than in the context of any other examination or ombudsperson model, especially given the context of her role. It's my understanding the commissioner approves and enjoys the role of ombudsperson and is not seeking order-making powers.
I know of no situation where documents that are covered by solicitor-client privilege should in fact somehow become part of the commissioner's investigation process.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
I'm not going to go any further. I expect you're all going to agree on that.
On the question, however, of order-making powers, today it's two to one against you, Ms. Siegel. I don't know what the overall count is, but that's an interesting issue. I don't know what the overall count is, but certainly it's an issue that needs to be debated by the committee.
I want to go on a little further. The difficulty is, of course.... The commissioner has said--as someone has just pointed out--it's on a case-by-case basis, and it was Mr. Bowman who raised the issue that there is no way to compensate loss. I think it was Mr. Bowman who said that.
There is the other issue of violations: violations of lack of consent, violations of lack of notification, violations of any breach of the legislation. That's if you find out it's happened. I can't believe there aren't going to be all kinds of examples where we don't even know. For instance, the passing around of lists all over the place. Someone told us that the commissioner has rarely imposed this rule of notifying the public that there have been violations.
I know you've all commented on this, but it's very important, because if you're going to have any teeth to this legislation--and I'm really directing my questions to you, Ms. Siegel, because you're the one who said the ombudsman process should continue. Will the legislation have any teeth without order-making powers?
Lawyer, Information Technology Association of Canada
I can only turn to experience, to the experiences of my members and my own experiences advising businesses on compliance.
First of all, I think we need to separate order-making powers from a duty to notify. First, with respect to order-making powers, order-making powers are not what will enhance privacy protection in our society. I don't think the Privacy Commissioner is looking for order-making powers. And setting up a type of tribunal for the Privacy Commissioner would have to seriously alter how we view the role of the Office of the Privacy Commissioner right now. It would change from that of an ombudsperson and an advocate-educator to that really of a tribunal, which is significantly different.
Order-making powers, I don't believe, are something you would want to see for privacy issues. For any of you who are familiar with the privacy dispute process, I've had the opportunity to be involved in a number of mediations with the Privacy Commissioner, and when you're involved in this sort of mediation and a dispute or a complaint against you, companies put on the table all of their most complex business processes.
The issue is, should somehow a tribunal be struck to deal with and order new processes for business? My suggestion is that's not something you would want to see happen. There are very few bodies, or individuals even, who have that sort of detailed business process expertise that goes to the root of some of the issues we're discussing today.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Mr. Bowman commented on compensating loss. Are Mr. Bowman's clients going to have to rely on tort law or contract law? Is that what you're saying?
Lawyer, Information Technology Association of Canada
But that's the case for all other claimants in society who feel they've somehow been wronged or suffered a loss.
When we're dealing with privacy breaches, in some instances they may result in some form of loss, but in the vast majority of instances they may not. And when it's appropriate and they have suffered damages, then it's open to them, as it is open to any other claimant in a society, to go to Federal Court and seek damages. I don't think we necessarily need to have in place a completely different system to treat losses in the privacy context.
The commissioner herself, I believe, sees that she's had ample ability in fact to help mould and change the direction of how companies comply with privacy. So, for example, if you've gone to the Privacy--
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Mr. Bowman wants to join in on this, so maybe you could wind up.
Lawyer, Information Technology Association of Canada
When you go to the Privacy Commissioner's website, for example, you'll see the whole host of findings that she has listed, and in very few instances has she had any trouble whatsoever in convincing an organization that it should somehow change its process. I'd say one of the most important instruments in her back pocket is the threat and the possibility that if an organization does not change its practices, she can use her power to name names.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
I bet she's only done it a couple of times.
Mr. Bowman.
Chair, National Privacy and Access Law Section, Canadian Bar Association
Thank you.
One thing we should say for the record is that the CBA, we think, has a balanced approach on a lot of these issues. On this issue, I think it actually is quite evident. In my statements, I wanted to reinforce the fact that our recommendation for order-making power is conditional upon an impartial tribunal model. We don't necessarily think the status quo is perfect, nor do we think that just slapping down order-making power for the Privacy Commissioner is the answer.
Conservative
David Tilson Conservative Dufferin—Caledon, ON
Somewhere out west--I don't know which one it is, Alberta or British Columbia--they have non-appealable decision-making power. What would you think of that model?
Chair, National Privacy and Access Law Section, Canadian Bar Association
We looked at both the Alberta and British Columbia models in coming up with our recommendations, but despite that and input of members from those jurisdictions, the recommendation was really to try to create a model in which the strengths of the Privacy Commissioner's Office advocacy investigations are left as they are, and to set up this tribunal with order-making powers. The reality right now is that companies that handle personal information simply don't fear the consequences of being found acting contrary to PIPEDA. I would agree that the naming of names is a stick. I wouldn't say it's a big stick, and I think that's reflected in our submission. This is coming from organizations and firms such as my own who advise private companies.
Liberal
The Chair Liberal Tom Wappel
Mr. Tilson, you're way over time, but I see Ian's hand up, so I'll recognize him.
Canada Research Chair in Ethics, Law and Technology, University of Ottawa, As an Individual
The professor doesn't put his hand up that often.
Canada Research Chair in Ethics, Law and Technology, University of Ottawa, As an Individual
I think in the context of the conversation we were just having, it's useful to note that of the more than 1,400 complaints that the Privacy Commissioner has received, only nine cases, as far as I can count them, have been commented on by the Federal Court, and not a single one has attracted a damage award, as far as I can tell. Three of the complainants were able to recoup their costs; four of the cases saw the court awarding no costs to either party; in two cases the complainant had to bear the costs for themselves as well as for their opponents. I would suggest that part of the impetus behind PIPEDA was a recognition that the private law was insufficient as a means of remedying some of the potential problems in an information age.
So I would suggest that the question isn't whether without order-making powers this legislation has any teeth. The question is, what kind of teeth make for the best system? If you would like me to continue, I would say why I think order-making power is important, but I'll leave it to the chair.
Liberal
The Chair Liberal Tom Wappel
I'll let someone else ask that question, because we're over time.
Just so we can be clear on this solicitor-client privilege issue, I want to quote directly from the commissioner's testimony before us. By the way, has anybody on the panel actually had an opportunity to literally read the decision in Blood Tribe? No.
She says this:
It [the decision] effectively allows organizations to shield information from our investigators with no independent verification that the documents in question do in fact contain information subject to solicitor-client privilege.
That's what she said. The way I read that, it seems to be that she's afraid someone could say, “Oh, you can't have that because it's subject to solicitor-client privilege”, and there's no way of checking to determine whether or not that alleged solicitor-client privilege is in fact in law. Would any of you have any problem, assuming that's the decision, if there were an independent way of verifying whether or not a solicitor-client privilege claim was in fact accurate?
I see a shaking of heads in the negative. Are we all agreed that it would be reasonable to at least have someone determine whether the claim was verified?