Information & Ethics Committee on Feb. 15th, 2007

[Christian Ouellet, Bloc, Brome—Missisquoi, QC]

No, I'm the one who said it. The fact that it is a code of ethics is what makes it voluntary.

[Corinne Pohlmann]

Yes, but this is based on our recommendations to members of our federation. However, in the case of small firms...

I don't think you can stop that. I don't know how you could, and I think it's a challenge for this committee to balance the fact that people want their information protected, but they want the convenience as well. They want to be able to buy online. They want to be able to set up their own little business or be a one-person operation and then find the clients they need by telephoning them. I think that's a challenge this committee faces in terms of trying to balance that protection with convenience and what people demand as consumers.

As for stalling an individual who is building a business and saying, you can't call that person and give them information, one, I don't know how you would police that, and two, that's how businesses are born. That's how they grow. That's how they make connections and network, and if you try to define that as work product information, I think that's difficult to do as well.

I don't know if I'm answering your question the way you were seeking, but I think it would be difficult to try to stop that, and I think it would also stifle entrepreneurship to a certain degree if you did try to.

[Christian Ouellet, Bloc, Brome—Missisquoi, QC]

Thank you.

Ms. Ireland, do you share this view of the problem associated with controlling information within small businesses? That's my first question.

Secondly, you said earlier that we need legislation that would sanction violators and even impose substantial fines on them. In your opinion, how could the act be amended to provide some way of identifying flaws in the system? Putting it another way, aside from the cases reported on in the newspapers, how do we unmask companies that fail to destroy information after a certain number of months? How do we do that?

[Margaret Anne Ireland]

To answer the second question first, how can we ensure that anybody respects any law? We put them out there, we encourage compliance, and we do the best we can. That's always an ongoing issue with any of these types of things. It's always an educational process. Sometimes you teach people, and sometimes you have to push them in the right direction.

Frequently I have a fairly benign view of humanity. I believe most people are not bad. If you show them what it is and why it needs to be done, they do it. But there are also people who, for whatever reason, take a rather laissez-faire approach to some things, and they're probably the ones who need to get slapped.

I'm trying to remember the first question.

[Christian Ouellet, Bloc, Brome—Missisquoi, QC]

I asked you if there was any danger of information circulating from one small business to another, without ever coming back to its source. We know that small business owners with no employees have little time to check back in their records. Isn't that right?

I once worked alone in a small firm and I know that the business always looked to the future and never went back and dealt with old files. That's not unusual in this case. People are there to work and to earn money, not merely to occupy a desk. Otherwise their business will fail. They are one-person operations, as we are seeing with 56% of the cases here.

So then, how can we ask them? Can we expect that after a certain period of time, they will dispose of the information in their possession?

[The Chair, Liberal, Tom Wappel]

I'll ask the witnesses if they have any comments on that question, and then we'll move to Mr. Stanton.

[Margaret Anne Ireland]

Just quickly, I think that relates to one of our suggestions that the amount of information you can collect should be limited and the amount of time it can be kept should be severely restricted. If you're only keeping it for a very short period of time, if you're destroying it every month or every ninety days, then that's not an issue.

[The Chair, Liberal, Tom Wappel]

Any comment, Madam Pohlmann?

[Corinne Pohlmann]

I'll just repeat what I said. Small businesses know their customers, they know their clients. They do the best they can. For the most part, they are good corporate citizens who are aware of this, who think it's important to protect their own information, and we believe they are doing what they can to protect the information of others.

[The Chair, Liberal, Tom Wappel]

Thank you.

Mr. Stanton, followed by Mr. Peterson.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chairman.

I want to direct my question to you, Ms. Ireland. In your presentation, you actually were quite outspoken on the issue of what I'll call outsourcing, for lack of a better word, or the notion that companies will take what is in some cases personal information and will use a third-party contractor who may be out of country.

PIPEDA currently allows that under the fourth paragraph of section 4.1 of schedule 1, and essentially says that companies or organizations would have to assure, by contract or other means, that these third-party organizations would provide at the very least a comparable level of protection for those types of services.

We had testimony from the Canadian Bankers Association, for example, that talked about the fact that outsourcing is a reality now, and that it in fact makes business more competitive. By extension, that provides more competitive prices for consumers.

Are you objecting to it just on principle? Could you reflect a little bit on why that would be so objectionable if these third-party companies provide that same level of protection?

[Margaret Anne Ireland]

We've had a number of people come to us with a number of concerns on this front. Their concerns have been about things going to another country where the protection may not be as secure. Yes, a company may be responsible here, but are they actually guaranteeing the same level of protection over there as they can here, when they're personally here looking at stuff?

The other thing is that in foreign countries, foreign businesses are subject to their own government's rules. We have had a number of people bring the question to us, especially because the American government has been so aggressive lately about collecting information. They don't want their information going to the United States because they don't want the American government nosing around in their affairs. This may be neither here nor there, but it is a concern of consumers.

[Bruce Stanton, Conservative, Simcoe North, ON]

I think we've heard some testimony on that aspect.

On another point, you talked in general terms about tightening up PIPEDA, about making sure protections, penalties, and enforcement would in fact be stronger than those the act currently provides. We heard some other accounts of situations and circumstances in which the current privacy laws don't avail the banks. For example, in one situation, a senior citizen might be under some kind of intimidation to show up at a teller's counter and provide information, with somebody standing right behind them. They spoke quite eloquently, I thought, about the need for a public interest exemption. In these kinds of exceptional circumstances—for example, in the example I mentioned—the bank would be able to contact a relative or someone like that. Currently PIPEDA doesn't allow that.

Would you favour this kind of public interest exemption in a case in which you clearly have a customer who is under some kind of intimidation or threat if they're not ready to disclose that type of information?

[Margaret Anne Ireland]

Actually, this is an instance that I can speak to, because I'm a former employee of a big bank. Where I worked, everyone was trained that in that type of instance you were to refuse to serve the customer. You were to send them home. In certain instances, such as with a senior citizen, you were to perhaps suggest that they might want to come back with a family member or some such thing like this. But you were under direct orders to refuse to complete a transaction or to provide a service.

This was where I worked, but I understand the frustration. There were a number of times when I would have loved to be able to phone the son of the 87-year-old man who wanted to buy $50,000 worth of gold and only had $52,000 in his account.

[Bruce Stanton, Conservative, Simcoe North, ON]

The hope here is that by doing so, you'd prevent this kind of fraud from happening to someone.

[Margaret Anne Ireland]

So I don't know, but I can understand the impulse for that. Is there another way around it?

[Bruce Stanton, Conservative, Simcoe North, ON]

That's exactly what we're examining here, and of course there has been a lot of testimony to that effect.

Finally, with regard to CFIB, Ms. Pohlmann, could you shed some light on the experience you saw in Alberta with PIPA? What kinds of barriers did that put on small business in Alberta? We've had a lot of talk about harmonization.

[Corinne Pohlmann]

The Personal Information Protection Act in Alberta actually goes somewhat beyond PIPEDA from a small business perspective, because it also has an order-making power. That made it a little bit more intimidating for them to deal with the Office of the Information and Privacy Commissioner, but that's less of an issue. Rather, it expanded to employee information.

In terms of what that did to our membership out there, it was quite amazing how that became the focus for small and medium-sized companies, because except for the 56% with no employees, every company has employees, for the most part. They were very concerned about how to deal with this issue. It caused much confusion. A number of calls that we got were about whether or not they could give a reference or even call about this employee. There were many questions and much confusion around what they could do with their employees or not do with their employees, how it linked to things like human rights and to employment standards.

It was really not well thought out, so we ended up doing a lot of work with the provincial government to try to put tools together and handouts together. There's a lot of information in that province today because of that, but I found that it just added this extra layer of anxiety to our membership in Alberta.

[The Chair, Liberal, Tom Wappel]

At present we have Mr. Peterson, Mr. Tilson, and Mr. Vincent. If anybody else wants to ask a question, please catch the eye of the clerk.

Mr. Peterson.

[Jim Peterson, Liberal, Willowdale, ON]

Ms. Ireland, do I read you correctly to say that you want to have much more precise prescriptive rules as to what type of information can be gathered, how long it can be kept, etc.? Would that be the same for big banks, big and small retail stores, and chains versus sole proprietors, etc.? Would those rules have to be tailored to every particular type of business, or would one size fit all?

[Margaret Anne Ireland]

I don't know if you need “one size fits all”, but we do need to limit what you can ask for. Does the phone company need your social insurance number?

[Jim Peterson, Liberal, Willowdale, ON]

That's one rule you would say. Phone companies cannot ask for SIN numbers.

[Margaret Anne Ireland]

No, do they need it? This is where we have to go. What do they need? What is the minimum they need in order to conduct their business?

[Jim Peterson, Liberal, Willowdale, ON]

There are some companies that may need your SIN number.

[Margaret Anne Ireland]

Yes, if you are going to a bank and you have investments and you have interest income, they would like your SIN number so that Revenue Canada can collect money from you.