Evidence of meeting #26 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
10:05 a.m.
General Counsel and Government Relations Officer, Credit Union Central of British Columbia
Thank you for highlighting another one of our submissions that we did not have an opportunity to highlight this morning.
You'll note in our submission that we've actually raised this as an area that perhaps could use a little bit of work, because the way the order in council was drafted it refers to specific activities as opposed to an organization. So an organization in British Columbia that is carrying on activities in British Columbia, as a B.C. credit union would do, is subject to the B.C. privacy legislation and would fall outside the scope of PIPEDA.
The B.C. legislation does say that if something falls under the scope of the federal legislation the B.C. legislation does not apply, so you're not going to have the same legislation apply in the same circumstance. But what's less clear because of the way the order in council was drafted was that the two different pieces of legislation could apply to the same organization in different circumstances.
10:05 a.m.
Conservative
Mike Wallace Conservative Burlington, ON
I appreciate that, because one of my views of the world is that we try to make things simple and the less overlap the better.
The one area you have a lot to do with, probably mainly from the banks but I think also from the credit unions' point of view, is business information when businesses are sold and people are investigating whether there's an interest in making a purchase or a sale and so on. Could you give me a layman's view of what actually happens, without taking too long? And how does PIPEDA help or hurt that, and what do we need to do to make that easier?
10:05 a.m.
Senior Vice-President, Corporate Operations and General Counsel, Canadian Bankers Association
Why don't I take a stab. I'm a lawyer, so I've been a through a few of these transactions in prior lives.
We have a simple deal to sell a company. We'll have business from company A to company B. Company B is interested in the assets that it's purchasing. The assets may include the employees of the business that it's purchasing. The problem under PIPEDA right now is that information concerning the name of the employee, address, etc., could be construed as personal information and therefore it would be difficult without the knowledge and consent of the particular employee to give that pertinent information to the prospective vendor of the company.
It's an asset that the purchaser is considering purchasing, but it's difficult to go through the due diligence process if you don't have that information. But because of the constraints in PIPEDA you can't give information with respect to employees.
10:05 a.m.
Conservative
Mike Wallace Conservative Burlington, ON
Do you have a specific recommendation on how the wording would change to allow that to be made simpler?
10:05 a.m.
Senior Vice-President, Corporate Operations and General Counsel, Canadian Bankers Association
I think it's been done in Alberta and B.C.
10:05 a.m.
Vice-President, Policy, Canadian Bankers Association
In fact what we do now.... Obviously, PIPEDA applies, and we rely upon the implied consent provisions in the legislation. What we're suggesting is it would be more useful for greater clarity and certainty.... Is it Alberta or is it British Columbia that is the suggestion we have?
10:05 a.m.
Vice-President, Policy, Canadian Bankers Association
Section 22 of the Alberta provision we think is very specific. It happens now. We can work it under PIPEDA, but our sense is that for greater certainty and for clarity, section 22 in Alberta would be a useful one.
10:05 a.m.
General Counsel and Government Relations Officer, Credit Union Central of British Columbia
Sure. I can reference section 20 of the B.C. act if you wanted the cross-reference.
10:05 a.m.
Conservative
Mike Wallace Conservative Burlington, ON
Okay. Thank you very much.
My third question is a quick one. The Privacy Commissioner.... As I mentioned earlier, I got a letter that some of my information has gone missing from a mutual fund. The newspaper portrayed it as if it weren't for the Privacy Commissioner pushing them to notify and to make it public, it would not have happened. Do you agree with that approach?
10:05 a.m.
Vice-President, Policy, Canadian Bankers Association
Let's go right back to what I was saying earlier. When there is a breach or an incident--let's call it an incident, you don't know if it's a breach yet--you don't know what the “it” is, and when you notify the police and the Privacy Commissioner, you have to do a fair amount of work to really get to the bottom of it before you know what has to be done. That involves a lot of back and forth. We rely upon the Privacy Commissioner. We have a very high regard for that office and for the Privacy Commissioner herself. We take not just their input, their guidance, but we also take their direction.
In the particular case you're talking about, there is an investigation going on, so until the investigation is done, it's hard to say either way. But I can tell you that generally you have to go through that process, because the facts of the case, every case, are going to be different. There are different ways you can notify. You can notify individuals directly through.... You can issue a press release, take out an ad in the paper. What's the appropriate way? There is no one template. There is an investigation going on in that particular case, but I can tell you one of the values of having the current system that we have—and we think it works—is it gives you the flexibility to determine the right course of action, quite frankly, in dialogue with the Privacy Commissioner. You can tailor it and you go from there.
10:10 a.m.
Director, Consumer Affairs, Canadian Bankers Association
It could be that the Privacy Commissioner suggested one type of notification and the bank thought another type of notification might have been more appropriate. Sometimes there is a different point of view.
10:10 a.m.
Liberal
The Chair Liberal Tom Wappel
Mr. Wallace, your time is up. Could you put your fourth question--just put it?
10:10 a.m.
Conservative
Mike Wallace Conservative Burlington, ON
The question was this. You mentioned that if somebody has unusual activity on their account, particularly a senior, it's a simple question. Is it in the Bank Act that you are required to notify, or is that just a customer service approach that you were taking?
10:10 a.m.
Vice-President, Policy, Canadian Bankers Association
There was actually a common law decision that said you can—
10:10 a.m.
Senior Vice-President, Corporate Operations and General Counsel, Canadian Bankers Association
The Tournier case.
10:10 a.m.
Vice-President, Policy, Canadian Bankers Association
Yes, the Tournier case, in which it said you had the ability to take those steps. With PIPEDA coming in with the stricter sets of rules, it hemmed that in. So we're suggesting there should be an amendment that goes back to that common law standard.
10:10 a.m.
Senior Vice-President, Corporate Operations and General Counsel, Canadian Bankers Association
Confidentiality has always been a part of banking, and the common law itself recognized that. The Tournier case was decided early in the 20th century and said yes, confidentiality is the hallmark of banking. There are certain very limited exceptions at common law where a bank is entitled to release information without consent, one of which is for public interest situations.
10:10 a.m.
Liberal
10:10 a.m.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Thank you very much, Mr. Chairman.
These ladies and gentlemen made an excellent presentation. They said that the changes they were proposing were of a technical nature and that overall they agreed with the legislation itself. Then they commented on the technical changes they were proposing. Their presentations were extremely interesting and their documents were excellent.
I'd like to give up my turn because we need to reserve a bit of time to discuss the Access to Information Act. I think that the Conservative members opposite will try to use all the time they will have left until the end, and by doing that, they'll have to force themselves to find more questions to ask and they will waste everybody's time, including the time of our distinguished guests.
Thank you, Mr. Chairman, but I'll give up my turn.
10:10 a.m.
Liberal
The Chair Liberal Tom Wappel
Madame Lavallée never gives up, does she?
Okay, good for you.
Mr. Stanton, can you rag the puck?
10:10 a.m.
Conservative
Bruce Stanton Conservative Simcoe North, ON
Thank you, Mr. Chairman.
Very briefly, Mr. Chairman, I have just a couple of questions.
I noticed through the course of our question and answer that some of this has already been brought up, but my central question is this. Both of your organizations have had the experience now of operating where there are provinces that have their own privacy legislation in place, in the three provinces that apply to at least your sector and also the federal government. I would have to believe that for the purposes of reviewing PIPEDA there are some lessons to be learned, both pro and con, in the provincial examples. There have been a couple of examples noted already: the question of business e-mail being a positive change; the definition of “investigation”; and then the last one that was identified through your discussions with Mr. Wallace, this overlap between activities versus organization.
Is there anything else that we should know? Are there any other lessons that we should be understanding to take forward from the provincial example that should be something we should consider for PIPEDA? What has worked extremely well that we should consider incorporating into any amendments for our consideration?
10:15 a.m.
Director, Consumer Affairs, Canadian Bankers Association
In our submission, there are a number of small suggestions that we haven't highlighted in our speaking notes and so on. They include things like the correction of professional and expert opinions.
Say there's a mortgage appraisal. Someone coming into a bank and asking for access to information may disagree with the value placed on their house. That's our appraiser's professional opinion and the person should not be able to correct it under PIPEDA, so the provincial legislation has dealt with that.
On collection of information in an individual's interest, the example we use in our submission is that I want to send my mother some flowers. Well, the florist has to get my mom's name and address for me to be able to send the flowers to her. Technically, that's a contravention of PIPEDA. There are a few little things like that.
Another one is found where access might preclude collection. In the employment context or in a whistle-blowing context, collecting that information and having someone have access to that might stop someone from whistle-blowing. There are a few things like that too.