Information & Ethics Committee on Feb. 13th, 2007

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Vincent, you have seven minutes.

[Robert Vincent, Bloc, Shefford, QC]

I am very happy that you came here today and presented us with this information.

Mr. Sullivan, if I understand you correctly, you would like that ISPs be allowed to disclose information when an Internet site contains child pornography. Is that correct?

[Steve Sullivan]

I'm saying they have the discretion to cooperate with law enforcement. When law enforcement makes a request to get the name of a potential suspect--subscriber information, name and address--they have a discretion to cooperate with law enforcement.

I think according to the legislation there's been some confusion, and Mr. Pecknold has referred to that, as to whether the companies can or can't without a warrant.

[Robert Vincent, Bloc, Shefford, QC]

What are you recommending? Do you recommend that ISPs be allowed to disclose that kind of information to th police? The same principle might apply to any other service, such as insurance, or any type of situation, for instance in case of theft. I understand that you would like the possibility to share information with law enforcement in any kind of investigation. Is that right?

[Steve Sullivan]

Obviously, our interest is Internet service providers because that's an area where children are being exploited by the Internet. Our recommendation is--and I only speak to the area of the Internet because that's the issue we're dealing with, children being exploited--that the legislation should be clarified so that the companies can provide information when police have lawful authority and make that request, and I think it should define what lawful authority means.

Also, we would go beyond that and say that certainly in the cases of child sexual exploitation, Internet service companies should not even have a discretion; that when police come and make a case that they need information, they should be required to share that information. That would be consistent with the legislation the former government introduced, Bill C-74, that would have made those requirements that companies had to cooperate with law enforcement.

[Robert Vincent, Bloc, Shefford, QC]

But you do not entirely agree with Mr. Pecknold who said that gas stations, stores, and so on, should provide that information when there is an investigation. You are only referring to the Internet and you do not want to authorize the police to investigate and obtain personal information on anyone at any time.

[Steve Sullivan]

I'm not saying there aren't other areas. I'm only speaking from our experience, so our comments are limited to the Internet service providers.

[Robert Vincent, Bloc, Shefford, QC]

Mr. Pecknold, I shall ask you the same question. Why should all kinds of personal information be shared with law enforcement when there is an investigation? Don't you fear that some police officers might abuse their power and pretend that they are conducting an investigation just to get information about someone?

[Clayton Pecknold]

First of all, let me clarify what type of information we're talking about. For example, when we're talking about ISPs, we're talking about customer name and address information. We're not talking about their Internet usage, we're not talking about what websites they've searched, or that sort of private information that would attract the necessity for us to obtain a warrant.

What we're talking about is saying to an ISP, or to a company or a gas station or a financial institution, that we're looking for so-and-so, and we're wondering if so-and-so is one of their customers, yes or no. That then allows us to go on a line of inquiry that may ultimately allow us to obtain the proper authorization to get the information for which we would require a warrant. What we find, though, is that some interpretations of the act are limiting some companies from actually telling us whether or not there is a customer there. We obviously then have a number of investigative steps we have to take when they don't allow us to get that information.

So for what we're looking for, we're talking about information that does not attract the section 8 charter protection. We're certainly not looking to read people's e-mails without warrant or go into their Internet usage without warrant. We would never ask for that. We don't intend to ask for that, and it's not the direction we're going in.

[Robert Vincent, Bloc, Shefford, QC]

Mr. Kimball, you said earlier that if you did lose three files, you would call those 2,500 clients. Do you consider it important? The representatives of other insurance companies told us that in that kind of situation, the decision to inform or not inform their clients was left to their discretion.

You work with a limited number of employees, but you make it your duty to call all your clients as soon as a file or information is lost in order to verify with them if that file contained personal information, don't you?

[Robert Kimball]

Thank you.

Luckily, first, we've never had any incident whatsoever of having a lost file. We do believe that if there is a file lost, we have to protect our client. That's the business we're in. We should notify that client and make sure we learn from whatever happened to make us lose that file.

Our question is whether or not it would be appropriate to worry all of the clients we have if, for instance, one file happened to be stolen from a briefcase while I was out visiting a client. We would not want to worry all of the clients when there was no possibility of a breach to them.

The business we're in as brokers is the protection business, so if some people are breached, we definitely want to let those people know so that they can protect themselves. We don't really feel it would be appropriate to worry all of the people who would be unaffected. We don't feel there would be any real benefit there.

I hope that answers your question.

[Robert Vincent, Bloc, Shefford, QC]

On what basis do you decide to tell or not tell your clients that personal information has been stolen from your files? How do you evaluate the risk?

[Robert Kimball]

Again, luckily, I have no experience at this, and virtually most brokers have not. What we have is the regular protection in our office, to make sure there hasn't been a breach, with the alarms, locks, etc. If there were a breach, we would look to what information we have, talk to that client, and let them know.

As insurance brokers, we do not carry or do not have very much information in our offices. For instance, we do not even collect social insurance numbers from our clients. We have no use for that information; therefore, we do not collect that. The amount of information we have is very limited.

We would let clients know right away if there was a breach, that their file went missing—here's the information we would have—and we would work with them to try to lessen whatever damage might affect them.

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Vincent.

Just before we go to Mr. Wallace, who is next, Mr. Sullivan and Mr. Pecknold, I understand you have a concern with the alleged vagueness of the term “lawful authority” in subsection 7(3). Are you concerned at all about the word “may” in the operative portion of the subsection? The reason I ask is that the way it reads, “an organization may disclose” only if, for example, required to comply with a subpoena. Are you concerned that somebody might say that “may” is permissive and not requiring? I'm just wondering.

Particularly in deference to the judiciary, as I found out in another committee I'm on, “may” is a very common drafting term. I don't know if you've highlighted any concerns. Maybe they're just my concerns. I'm just asking if you have concerns with the word “may”, and let's use it specifically as linked to paragraph 7(3)(c), because it would seem to me that if there's a subpoena or warrant, it should be “shall”. There should be no discretion if it's in accordance with a subpoena or warrant.

So that's just a quick question. Do you have concerns with the use of the word “may” in subsection 7(3)?

[Clayton Pecknold]

I hadn't noticed that, Mr. Chair, but what you're noticing there is in fact the problem in the Telus Mobility case. If you look at that word “may”, it conflicts with the fact that, in our view, a court order is a must. That always seems self-evident to us, but what we're finding is that, especially when electronic data is archived or there is some cost to the company to produce the data or get it out of archives, they view their ability to set a fee as a precondition for compliance with that court order. The CACP is on record as saying very clearly that this is an erosion of the authority of the courts, and that if the legislation doesn't provide for a fee, there is no fee. An order of the court is an order of the court is an order of the court.

[The Chair, Liberal, Tom Wappel]

To my way of thinking, what the drafters really meant instead of “may” was “is permitted to”, because this is a description of when organizations are permitted to release information without consent. Rather than the word “may”, I think what was meant was “is permitted to disclose personal information”, etc., whereas “may” could give the impression that there's some discretion.

Thank you.

Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chairman. I will ask all three groups a question or two, but I'm going to start with the insurance group.

You talked about work product, and it's unclear in this legislation nationally. I think there are definitions in the privacy legislation provincially in Alberta and British Columbia, and possibly in Quebec, although I'm not positive about Quebec's.

My first question is whether or not you have a definition with you. Do you have any changes to the wording that you would like to see in the legislation at present?

[Peter Fredericks]

No, and I apologize for that. We haven't actually gotten that far with it. What we look at is proprietary. As an example, if I insure your home, I have to get information from you. You may provide me with photos of your home, you may provide me with a photo of your wood stove, or you may provide me with different appraisals on jewellery items. Those would certainly be considered to be your personal items, and in the event that we no longer did business, you would certainly be entitled to get those things back. We have no concern with that.

What we're looking at is when we do, for example, a calculator. You provide me with the information on your home, the number of floors, the square footage, the number of bathrooms, and the built-in kitchen appliances. From that, I would use a calculator that would determine the value of your home. It's a product that each insurance broker would buy from three different providers.

In the event that you chose to take your business elsewhere, we would feel that particular piece would in fact belong to the brokerage. It would really give you an advantage or give your next broker or direct writer an advantage if we had to provide that to you.

[Mike Wallace, Conservative, Burlington, ON]

Just so I am absolutely clear, you're obviously not opposed to notification. Right now the legislation nationally is working with the commissioner on whether notification is required or not, but there is some discussion about making notification a requirement. You'd like it to be narrow enough or specific enough to apply to those who are directly affected, and not to everybody who is generally a customer, for example. Is that correct?

[Peter Fredericks]

That is absolutely the case.

[Mike Wallace, Conservative, Burlington, ON]

My next question is for the police association.

Again, section 7 talks about lawful authority, which you were just talking about. Do you have a new definition for us at all? Have you worked on that? I've been asking every delegation we've seen since the beginning of time on this review whether they had specific wording or not. Do you have specific wording on that particular issue?

[Clayton Pecknold]

No, I haven't put my mind to it, and it would probably be dangerous for me to try to draft legislation on the fly, but the key point for us, obviously, is the clarity that it's those circumstances that don't require a warrant.

[Mike Wallace, Conservative, Burlington, ON]

Okay.

Then in section 9, about prohibition of disclosure to police, you'd like to see the wording changed, if I heard you correctly, so they don't have a choice, in a sense. They disclose to you, the police, and then you have the option of consenting that it be disclosed to those whom you may be investigating. Is that an accurate statement?

[Clayton Pecknold]

Well, obviously, our ability to withhold consent would have to be reviewable by the Privacy Commissioner. We'd make the point that it can't be absolute. We understand there has to be a mechanism of oversight. But rather than it being triggered by a request and then a subsequent objection, we would just like to see it mandatory that they not disclose the fact that we requested the information, unless the Privacy Commissioner so orders, for example.

[Mike Wallace, Conservative, Burlington, ON]

Okay. Do you know if that exists in the other privacy legislation, in provincial privacy legislation?

If you don't know, it's fine. We'll find out.