Evidence of meeting #27 for Access to Information, Privacy and Ethics in the 39th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Liberal
Bloc
Robert Vincent Bloc Shefford, QC
Thank you, Mr. Chairman.
I am going to continue in the same vein as just now. I am confused. If there is a theft or something happens in one of your organizations, you feel you have the leisure to reveal it or do something, be it at the level of the Canadian Chamber of Commerce, businesses, or, as I understood it, insurance companies.
Could the Act not state that, as soon as a party realizes there has been a theft or something of the sort, it must advise the commissioner, who conducts an investigation to determine the repercussions of such an event on the personal information of people who deal with your organizations?
Should there not be a section in the Act that encompasses this type of problem, rather than leaving it to the organization to judge the appropriateness of revealing it?
Senior Vice-President, Quebec Affairs, Canadian Life and Health Insurance Association Inc.
In general, that remains a business risk. I think that the company must ensure that revealing information does not create more problems than it solves. In that respect, many of these things relate to the daily routine. Procedures will be adopted automatically and firewalls will be adapted as a consequence. Companies have risk-management systems, and these things will therefore be contained very quickly. The procedure will become very cumbersome if there is a requirement to notify the regulator every time. In every case of the slightest importance, the regulator will be involved.
Bloc
Robert Vincent Bloc Shefford, QC
I agree with you. If you think it is important, the commissioner could decide, without making the process cumbersome and endangering the company, that it’s all right and that the matter won’t go any further, that there is no need for disclosure. However, that a third party make a decision in a given matter without leaving it to the company itself—
I understand your point of view. It risks being more damaging for the company, but not the consumer. Consumers who trust a company can turn over personal information. I am not talking just about you, but about all the people who trust that company and who know that their personal information is safe. Yet, we have seen today that it is no longer that safe.
February 1st, 2007 / 10:50 a.m.
Senior Vice-President, Quebec Affairs, Canadian Life and Health Insurance Association Inc.
The point of our recommendation was to examine these things and, through directives, to establish a procedure that would benefit everyone and not go completely to the other extreme, of having to inform the commissioner of every situation, which could be counterproductive for the conduct of business.
Bloc
Robert Vincent Bloc Shefford, QC
OK.
Earlier, I asked Mr. Murphy to talk about the Internet. In 2006, the Canadian Internet Policy and Public Interest Clinic published a study of 64 on-line retailers to see if they were complying with the Act. The study revealed that a certain number of retailers were not respecting the fundamental requirements to protect personal information.
Do you think that the problem this study brought to light reflects the fact that companies are not aware of the Act’s requirements, downplay it and hope they don’t get caught, while continuing to operate in any old fashion?
Executive Vice-President, Policy, Canadian Chamber of Commerce
This is the central question in terms of the educational component here in dealing with companies, specifically in trying to raise the bar, if I could put it that way, on knowledge, something that the Privacy Commissioner has said is one of the objectives for her office, and I think she'd like to have more resource power there dedicated to doing more of that rather than some of the things that she had to do earlier on in her term.
In a perfect world, you don't have anybody who's missing in terms of understanding their obligations under the act. I mean, are we in that situation today? I'd never want to make that statement, given the number of businesses that are out there, but from the standpoint of where we are, I think from the standpoint of companies in Canada and coping with this legislation, I'll use the words of the Privacy Commissioner, that the system is working well. I think she has not only said that here, she has said it elsewhere. That's the fundamental premise on which we start the discussion here. So I think we start from a position of reasonable strength and look for ways to continuously improve.
I'll leave it at that, Mr. Chairman.
Liberal
The Chair Liberal Tom Wappel
Okay, that's a good place to leave it in completion.
Madame Philp and gentlemen, I would like to thank you on behalf of the committee very much. I'm sure you can appreciate that there's a great deal of interest in this subject matter by the committee members, based on the questions you had to field today.
Good luck with your redesigning of the website, and good luck with your members. I know if I were in small business, this particular statute, among many others that governments impose on businesses, would be perplexing to me. So many thanks for appearing today and for giving us your advice.
Members, our next meeting will be on Tuesday, at 9 a.m. It's very likely I will not be here, so I've asked Mr. Tilson to take the chair on that day. Thank you.
I adjourn the meeting.
