Information & Ethics Committee on Feb. 1st, 2007

[The Chair, Liberal, Tom Wappel]

That's understood. I'm just trying to figure this out. In a bottom-line scenario, it's the company that decides what is a material breach--yes?

[Frank Zinatelli]

Under the current rules, that would be my understanding of it.

[The Chair, Liberal, Tom Wappel]

Yes, as it would be mine. Okay.

We go to Mr. Van Kesteren, followed by Mr. Peterson, followed by Mr. Tilson.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you, Mr. Chair.

I am of the opinion—and I said this yesterday too—that the insurance industry probably could have written a book on privacy. I think you have done a good job. I think there is always room for improvement. We've heard some great questions and we need some direction in certain areas.

I am concerned about one thing, though. I stated yesterday that most of this has come about because of the information age and things that none of us expected or anticipated.

I want to direct a question, and I think I should direct this question to you, Ms. Philp. With Sun Life, for instance, or the insurance industry generally, when you have overseas ventures like in China.... I understand in that particular case that the advantage you have over other companies is that you have an integrated system. In a case like China, where they take 50% ownership or the government is a partner, what kinds of safeguards do you have if you have an integrated system? For instance, in the government here, I think Sun Life has our insurance policy. What do we have for safeguards that some of that information isn't going to get out?

[Dale Philp]

I'm not exactly certain what systems we share with China, if any. I think it's a totally distinct business operation over there. I'm virtually certain there is no sharing of our access to information in Canada with China, other than maybe on a business level for directors and with the financial results of the company, as opposed to personal information.

As for the public service health care plan that is administered by Sun Life, there is no access to information from anywhere outside Canada to information under that plan.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Okay.

The other area is that you mentioned something about requests from lawyers. I suppose they would access it through the Access to Information Act. Some of this information is being used in trial cases--did I understand that correctly? Is that something that should be addressed, perhaps through the Criminal Code, so that if information is obtained through the access to information process, it would not be admissible in court? Is that something you have looked at?

[Dale Philp]

Maybe Frank can answer that one.

[Frank Zinatelli]

It really is something that needs to be looked at in the context of the privacy legislation, because that is the place where the right of access is provided, with a list of exemptions. In our brief we were pointing to the Quebec example, where they have looked at that situation and indicated that not all of that information should necessarily be accessible all the time. You've got to look at circumstances where that information might lead. That is not the purpose of the privacy legislation, at least in Quebec. So they have moved a little bit further to restrict when that information can be disclosed. I see the parallel being in PIPEDA, as opposed to any other statute.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

So the solution is just to change some of the rules?

[Frank Zinatelli]

Yes, and to look at the Quebec rule in determining that and to try to bring this in parallel with the rules there.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Okay, that's all.

[The Chair, Liberal, Tom Wappel]

Mr. Peterson.

[Jim Peterson, Liberal, Willowdale, ON]

Mr. Zinatelli, you said that in practice, if there is a breach of privacy, the Privacy Commissioner is notified by companies in all circumstances. Do you think we should make that requirement mandatory?

[Frank Zinatelli]

Actually, in the circumstances I am aware of, there has been notification. Should it be made mandatory? I think whether or not something like that should be made mandatory is a question that should be looked at down the road. I'll give you one of the reasons.

[Jim Peterson, Liberal, Willowdale, ON]

But not today.

[Frank Zinatelli]

And the reason for that is that all sorts of rules about notifications are being developed by various parties, such as the Privacy Commissioner.

We've heard from the chairman of two other instances where I believe Ontario and one of the other provinces--

[The Chair, Liberal, Tom Wappel]

B.C.

[Frank Zinatelli]

--have come up with these guidelines.

So let's see, in the coming period, what the consensus is as to what those rules should be and then let's see.

[Jim Peterson, Liberal, Willowdale, ON]

I agree. Thank you.

Ms. Philp, the main thrust of your presentation was on how we can benefit from harmonization. Do you have any estimate of how much time is wasted or is made redundant by overlap and duplication with provincial laws? Do you have any horror stories? How bad is the overlap and duplication? I'm sure you see a lot of it from your vantage point in the company.

[Dale Philp]

I do, and I see it when we have a situation of employee fraud, not our employee fraud, but an employer's employee fraud. And my first question is what province are we in, is it Quebec, is it B.C., or Alberta, because I want to know how we have to deal with that information and if we need to get the consent of the individual to share with others.

And there is another situation where we're administering the self-insured employer's benefit plan. We're not the insurance company, we're the agent; we're administering. When there is an employee fraud--their employee's fraud--we, without consent, can't share that information with the employer unless we're in Alberta or B.C.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.

I want to say how much I appreciate your specific examples of how we could eliminate overlap and duplication.

The chamber said to make no changes to PIPEDA at this time. Would you modify that to allow us to make changes of the nature outlined by the insurers, with respect to overlap and duplication, to move toward harmonization?

[Michael Murphy]

This is an area that was of pretty big concern to us, particularly at the time B.C. and Alberta were looking at their legislation, which didn't exist until we got going at the federal level. It was about the same time.

I heard from members all the time about how worrying this was going to be for them. There are examples specifically, and I think you've heard it expressed very well here of where there may still be some concerns. But on the broad level, is that concern still reflected in my membership, broadly? No, it's not. So I don't have anything specific to suggest, and I certainly don't want to take issue with what our friends in life and health insurance are saying.

David, do you have anything to add? No? Okay.

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Peterson.

Mr. Tilson, and we'll follow Mr. Tilson with Mr. Dhaliwal. That's the last person I have on the list at this time.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Okay, thank you.

To the Chamber of Commerce, I represent a community known as the beautiful town of Orangeville, Ontario.

[The Chair, Liberal, Tom Wappel]

Orange County, did you say?