Information & Ethics Committee on Feb. 8th, 2007

[Robert Johnson]

It falls to a commercial entity. For instance, in Europe, there was a time when United Airlines was not allowed to fly into Switzerland for about two hours because they had collected data that the data protection directives said it was unnecessary to collect.

Also in Switzerland, I think, Coca-Cola was shut down, or had the threat of being shut down, because Coca-Cola was collecting more information than it needed to. The only enforcement the Swiss could do against the multinational corporation was to say the corporation was not going to operate in their country if they were not going to comply with Swiss--

[Pat Martin, NDP, Winnipeg Centre, MB]

That would smarten them up pretty quickly, though.

[Robert Johnson]

It worked very effectively.

[Pat Martin, NDP, Winnipeg Centre, MB]

I think Ms. Fineberg wanted to add something. Do I have a small window—

[The Vice-Chair, Conservative, David Tilson]

If it's very brief, you have about 15 seconds, Mr. Martin.

[Anita Fineberg]

On the transborder issue, we have no personal health information stored in the U.S., but I'd refer the committee to two orders of the federal commissioner dealing precisely with that issue. She has ruled that contractual mechanisms between a company in Canada that outsources the data—

[The Vice-Chair, Conservative, David Tilson]

I think it's actually in the act.

[Anita Fineberg]

It is, and she's ruled that to be sufficient when somebody has objected.

[The Vice-Chair, Conservative, David Tilson]

Thank you, Ms. Fineberg.

Mr. Stanton.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

My thanks to our panel for attending this morning. With just seven minutes, I'm going to divide as equally as I can here, because I do have two questions for each of the two groups represented here.

First to Ms. Fineberg, I'm actually referring to the recommendation that you have put on page 34 of your submission, which is the actual text of what you're proposing in relation to your work product information and how to include that as an exception to the definition of personal information.

Specifically, in your second recommendation, which talks about the definition of work product information, subsection (i) says that work product information “does not include—personal information about an identifiable individual who did not prepare, compile or disclose the information”, and then it goes on to talk about the surveillance issue. It's good that you see the surveillance issue covered.

My question really is, from a practical point of view, who are we really talking about here? Could you give me a practical example of who would be excluded here?

[Anita Fineberg]

Since we've mentioned and you've heard about the prescription issue or the medical record issue, I'll use that, if I might, to illustrate what we're talking about in the first section.

For example, say you have a prescription. That's information that was prepared by a physician, but if it has identifiable information in it about the patient—the patient's name is still in it—that part is personal information about an identifiable individual, the patient, who did not prepare, compile, or disclose it. So if both parties are identified—the preparer of the document, meaning the physician, and the PI, meaning the personal information, about the subject—

[Bruce Stanton, Conservative, Simcoe North, ON]

The patient.

[Anita Fineberg]

—the patient, yes—it is not work product, so the information is not excluded.

To get back to the same example, where none of the patient identifiers appear and it's again the physician who has prepared it, then it becomes work product information.

[Bruce Stanton, Conservative, Simcoe North, ON]

If I can summarize, then, work product information effectively includes, for example, reports and other materials prepared by individuals or groups in the course of their profession, but if there's some personal information embedded in that—

[Anita Fineberg]

Correct.

[Bruce Stanton, Conservative, Simcoe North, ON]

—it would still be considered personal information.

[Anita Fineberg]

That's right, if it's about another individual. That's correct.

[Bruce Stanton, Conservative, Simcoe North, ON]

You mentioned that although there have been judgments by the Office of the Privacy Commissioner as well as by the Federal Court, your concern is that without getting this clarification, there could be another complaint that could in fact lead to the commissioner's taking a different view.

What is the commissioner's track record on these types of issues? Has she—or he, in the past—given any indication that precedents have not been followed in these types of cases?

[Anita Fineberg]

If I might clarify a couple of things with respect to this particular issue, there was the finding on the complaints in the IMS situation of the previous commissioner. The Federal Court did not rule on that; it was dismissed on consent of all parties.

Then last year a finding was issued by the commissioner's office, not on this particular type of information but on information related to real estate agents. The finding in that particular case was that the information at issue was in fact personal information. As a result of that, a number of commentators said this must have overruled the IMS decision, so IMS's practice—

[Bruce Stanton, Conservative, Simcoe North, ON]

I don't want to cut you off, but I just want to keep going here. Thank you very much.

Mr. Carey, the direction you're heading in would be very good for your industry, and I think we get the point there. Do you have any knowledge to suggest that any of the breaches you described were in fact brought before the Privacy Commissioner in terms of a complaint?

[Dave Carey]

Yes. Rob, do you want to touch on the exact details?

[Robert Johnson]

Without getting into each individual case, I can tell you that each of them was handled at the provincial level through the provincial privacy and information commissioners; investigations were conducted, and results are either pending or have been produced in all of these cases.

[Bruce Stanton, Conservative, Simcoe North, ON]

Were these breaches, then, in Alberta, B.C., or Quebec?

[Robert Johnson]

They were in Ontario. The movie set incident happened in Toronto.

[Bruce Stanton, Conservative, Simcoe North, ON]

Did that have to do with the health records?