Information & Ethics Committee on Jan. 30th, 2007

[David Tilson, Conservative, Dufferin—Caledon, ON]

I'd like to move on to another question, if I have time.

I'm just going to tell you that I've had it happen to me personally, on two occasions, with a credit card company, which of course is tied in with the bank. They have notified me that someone may be using my card information inappropriately. I have appreciated that. I have been concerned, yes, but I want to be notified.

My question is for Ms. Loui-Ying, and anyone else who is a lawyer. She's the only one who is admitting she is a lawyer.

The question has to do with outsourcing. I find this business of people in India and China, whether it's telemarketing...an unbelievable thing. They're being trained. They call somebody in Texas, and some Indian is being trained to talk with a Texas accent. It's unbelievable. Massive information is being outsourced. I'm told accountants outsource their information to people in India to do income tax returns in our country. It is mind-boggling.

My question has to do with the comment--I believe it was Mr. Law's--on the issue of contravention of foreign law. That's an interesting topic. I gather you're saying there is a difficulty on that issue.

[Warren Law]

It's a problem with the investigative bodies.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Are there other areas we should be looking at? I'm thinking, for example, of the issue of reciprocal agreements with foreign jurisdictions such as we do in other areas of the law on enforcing. Our laws could be different from laws in India or the United Kingdom or any other country.

[The Chair, Liberal, Tom Wappel]

Mr. Tilson, I've allowed you a lot of leeway. You asked the question.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Well, think about that, and we'll come back to it.

[The Chair, Liberal, Tom Wappel]

Mr. Tilson asked the question. I believe it was to Mrs. Loui-Ying and any other lawyers.

[Charlene Loui-Ying]

The issue of outsourcing is actually one of the matters that we did not address or highlight in the presentation this morning. Canadian Central does have a position on outsourcing. Recognizing that, for the most part, outsourcing is a business reality, as pointed out by our colleagues, credit unions generally don't have the size and scope for the same bargaining power in outsourcing agreements that other larger organizations, particularly federally regulated organizations, might have. That said, there has been discussion among members of Canadian Central about the need to share information with other jurisdictions. The general feeling at this point is that the mechanisms already in place are appropriate, so that perhaps the Privacy Commissioner does not need a direct mechanism, as might have been contemplated in some of her submissions, since there are other mechanisms in place for information sharing at that level.

[The Chair, Liberal, Tom Wappel]

Ms. Routledge had her hand up.

[Linda Routledge]

Sorry, Mr. Law.

On the issue of outsourcing, the banks have the obligation under PIPEDA to protect the information they collect. So when they outsource, their outsourcers are agents, and they will have contracts in place with those agents to make sure that those agents offer the same protection as the banks would offer if they were holding the information and doing the job themselves.

[The Chair, Liberal, Tom Wappel]

Did you want to add anything?

[Warren Law]

The only thing I can add to that is the fact that you have a specific guideline, the OSFI guideline, that deals with outsourcing on the part of the banks, and it provides another controlling mechanism regarding the extent to which information can be outsourced.

[The Chair, Liberal, Tom Wappel]

Thank you.

Both Mr. Peterson and Mr. Tilson raised more or less the same point, that you seem to be more or less in agreement on things. I don't know if it's just me, but I detect a nuanced difference in your approach to what one calls breach notification and the other one calls duty to notify.

The banks say they do not believe that legislative requirements are needed, period, full stop, end of story. The credit unions support in principle the concept of duty to notify, but if the Government of Canada decides to legislate, there should be a reasonable threshold. That's not quite the same as saying there should be no legislative requirements. Am I right in that interpretation? Yes? Okay, thank you.

Mr. Dhaliwal.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

Thank you to the panel that came out today.

When I look at the corporate groups, they are already defined under the Income Tax Act. How is your definition any different from what falls under the Income Tax Act when it comes to corporate groups?

[Warren Law]

I don't think we've gone down to that level of detail, but I think it would probably be the same affiliates and subsidiaries. The fact of the matter is--and this is a point I made in my opening remarks--that banks, as do a lot of corporations, operate as a corporate group now. Within a banking group you have a mutual fund dealer, a trust company perhaps, a securities dealer, and a bunch of companies carrying on different kinds of businesses, but for all intents and purposes they operate as one group. I think, as a result, it would be useful if you could share information among the particular companies within that group in an effort to prevent fraud.

I know of situations that have happened in the banking industry, for example, in which our BCPIO, our investigative body, has been seized of information concerning fraudulent activity, money-laundering activity, but it has been unable to share that information with a subsidiary of one of our member banks because of the fact that PIPEDA does not operate on a corporate groups approach. As a result, I think it would certainly be beneficial for this committee to consider making amendments to the act to allow corporate groups to share information among the members of their group.

[Gary Rogers]

Specifically to your question about the Income Tax Act definition, it probably doesn't work well enough in this instance. In the credit union system we have a large number of players with very small shareholder interests, so therefore the concept of associated corporations and related corporations in the Income Tax Act wouldn't be broad enough to cover what would be intended here for privacy purposes. We're interested in having a conversation about how that could be defined appropriately.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

The question is, on the one hand we are saying that we should be carefully considering the modifications to PIPEDA, and on the other hand, we are saying that it's only a two-year-old act and we should not touch it. Why would you have a conflicting statement in your own proceedings?

[Charlene Loui-Ying]

I'm not sure it's so much of a conflict, but saying we recognize some tweaking is needed, to use the word of the day. It's not so much an overhaul, but we need to look at changing the whole way privacy operates in Canada. Because of the statutory review, it is useful to take a look and say what's been going on in other jurisdictions and what's been working well. Are there things that can help improve this legislation for the benefit of all Canadians to make it work more effectively so it's more cost-efficient for business and more effective for consumers as well? I'm not sure we meant it to be a conflict, but more part of the continuum.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

With technologies changing every second, do you still think there should be no changes made to cover the technology we have today, rather than what we had two years ago in the banking industry?

[Charlene Loui-Ying]

Because this has a lot of general application, I'm not sure it speaks specifically to any particular technology. You're speaking to personal information here and what you're talking about is the scope of personal information.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

On identity theft, when it comes to all those issues, in outsourcing you said there are issues with identity theft as well as going from one country to the other. We didn't have outsourcing two years ago or ten years ago to the extent we have it today. Depending on that country's law, I don't feel very comfortable when it comes to outsourcing and saying we should have the laws from two years ago.

[Charlene Loui-Ying]

If you look at the provisions of the act, it would apply generally to whether the manner of outsourcing worked five years ago or today. As my colleague has pointed out, the law says you are responsible for that personal information. When you outsource or use agents, you have to have them agree to protect it the same way you have to protect it.

I'm not sure it's the delivery method, with the exception of business e-mail addresses, where perhaps e-mail was less trusted five years ago than it is perhaps in the business community today. I'm not sure there are significant changes that aren't captured by the existing wording. If you examine that, you might come to the conclusion that the existing wording does deal with some of these changes and might have been worded generally enough to accommodate future changes in technology or relationships.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Wallace, followed by Madame Lavallée.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chairman.

Thank you for coming this morning.

I have four questions for you, and I don't think it will take too long.

I've spoken to other groups about the fact that there are privacy PIPEDA-type acts both in Quebec and British Columbia. Since you're a national organization, how is that treated, and which one takes precedence over the other in each? Does the B.C. law take precedence over the federal? How does that work from a practical point of view from the main perspective?

[Linda Routledge]

PIPEDA applies to federal works and undertakings across the country. If it's a bank, telecom, or transportation company, PIPEDA applies wherever you are. The provincial legislation does not apply. In B.C., Alberta, and Quebec, for provincially regulated organizations, those acts apply, and PIPEDA does not apply. In provinces where there is no provincial legislation, PIPEDA applies to the commercial operations of organizations. Nothing covers not-for-profits and so on.