Information & Ethics Committee on Feb. 20th, 2007

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Aren't there laws in place for compliance? Even if you are not responsible for the crime, if you've helped in another way aren't there laws in place for—

[Supt Art Crockett]

It would be for harbouring a crime, or being party to an offence.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

That's the one.

[Supt Art Crockett]

Yes, there are; however, we are in the very early stages and we have yet to determine that there is a crime. At the point when we know a crime has been committed and who the parties are, we won't be asking subtle questions; we will be seeking the authority and support of the court to obtain that information. It is in the very early stages that we're talking about.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

The current act has been criticized for not having any teeth. Presently, upon investigating, the commissioner may publicly expose companies that have breached the act. That's basically the deterrent we have.

Does the act allow for the same action by the commissioner for the police? If it doesn't, should it? In other words, if the police, like any corporation, were to breach the act, the letter or intent of the law, does the Privacy Commissioner have the power to publicly chastise the police?

[A/Commr Bruce Rogerson]

Yes, and I'll talk about the Public Complaints Commission because that's the number one watchdog.

As you know, with the recent O'Connor report and stuff like that, in the near future the RCMP will have an oversight committee and a governance structure. Throughout Canada your municipal boards, police boards, and committees can take action long before it gets to the Privacy Commissioner if somebody misuses the information.

I often think we're the defenders of human rights and protect basic privileges. Along with all that oversight are the number of regulations we fall within that allow us to take immediate action against anybody who violates the trust we have been given through PIPEDA, and ask for that information. If that information is not in line with the execution of their duties, a number of regulations and guidelines allow us to discipline an individual for outright breach and, depending on the severity of what they exchanged, determine the level of sanction against the individual.

Under our new commissioner, the direction to the Privacy Commissioner on public complaints is that our books are open. They can have access to see if there's any abuse. The Auditor General, who has been in to our organization on numerous occasions, represents the best interests of Canadians as a whole. She has never identified that we've misused this type of information.

So in light of what you've asked, the answer is yes.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Mr. Crockett, if you're party to a crime--and I know this doesn't deal with the Privacy Commissioner or the Privacy Act—can the service provider be charged if they have provided service to somebody that's—?

[Supt Art Crockett]

Yes. Under the Criminal Code a person can be held accountable for actions in which they have aided in a criminal offence. If they are party to an offence they can be held accountable.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you.

[The Chair, Liberal, Tom Wappel]

Mr. Martin.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you, Mr. Chairman.

Let me just start by saying that I do understand the point you've raised, and I do have some sympathy for the points you've raised, especially in the identification of pedophiles, etc. I'm trying to go beyond that, though, to explore what PIPEDA means to the RCMP in the context of, let's say, terrorist investigations, where it may be CSIS or the RCMP.

Under PIPEDA—and Mr. Stanton is correct in the chapter and verse that he cited—information collected by a private sector organization in secret, and without any constraints other than that the organization has suspicion that something is going on, that information could well be handed over to the RCMP and form the basis of a charge. Wouldn't that fit under the rubric of tainted evidence, if the information was garnered in a way that violated the individual's expectation of privacy, because he had a relationship with that company, maybe even a contractual relationship that guaranteed him the right to privacy that information wouldn't be used?

To me it opens the door, because private sector organizations don't operate under the same legal obligations as law enforcement and national security. You would have to have reasonable grounds to suspect something illegal was going on. They—the language used here—are “suspect”. So if your boss has a suspicion that you have something in your locker, that's all he needs to go on. You need something greater than that, reasonable grounds. I think that it's a slippery slope to tainted evidence, leading to possibly righteous convictions, but from a tainted evidence source.

[Supt Earla-Kim McColl]

It depends on how the investigation commences. If they're acting on the direction of the police, then they're an agent of the state, and there are considerable checks and balances involved. If they're doing it on their own and then they hand it over, then our involvement starts when they hand it to us.

[Pat Martin, NDP, Winnipeg Centre, MB]

That's exactly what the change to the Public Safety Act dictates, that they can collect this information at your request, which is one thing, but would have some controls, or the organization may now collect information on its own initiative and then make subsequent disclosures under PIPEDA. Even though PIPEDA binds them to keep your information sacred as its primary obligation, it also may hand that information over to you, which may result in a charge and a deportation to a country, because they suspect some Muslim guy is a terrorist because of what he said in the lunchroom.

[Supt Art Crockett]

Any and all evidence that is collected in any type of investigation, if it goes before the court will be judged on its merit, and the protections that fall within—

[Pat Martin, NDP, Winnipeg Centre, MB]

But what used to be tainted evidence is now okay, because of PIPEDA.

[Supt Art Crockett]

PIPEDA protects the person who shares the information with the police. The police will still be accountable for the evidence they obtained and how that evidence was obtained. The court will still hold the Crown accountable for the evidence itself.

[Pat Martin, NDP, Winnipeg Centre, MB]

But the gathering of it, they're not bound by the same rules of gathering evidence, etc. A private organization, if operating on its own initiative, doesn't have any of the constraints that a law enforcement agency has.

[Supt Art Crockett]

But the evidence will still be—

[The Chair, Liberal, Tom Wappel]

Excuse me, Mr. Martin. Could you refer us to the exact section that you're referring to, please?

[Pat Martin, NDP, Winnipeg Centre, MB]

I apologize, I didn't bring all of my files. I'll bring it to the—

[The Chair, Liberal, Tom Wappel]

As you're asking the questions, I'm trying to find in my copy of the act the specific wording that you're looking for, and I can't find it. Now, that's not to say it isn't there, I just can't find it. I'm a little hesitant to have the witnesses answer questions based on your interpretation of a section if we can't have it in front of us to take a look at what the actual wording is.

That's no disrespect to your recollection, but I can't find it.

[Pat Martin, NDP, Winnipeg Centre, MB]

I understand, although I do sense we're getting some agreement from the RCMP that this is the way they understand PIPEDA as well.

[The Chair, Liberal, Tom Wappel]

Okay. Good.

[Pat Martin, NDP, Winnipeg Centre, MB]

They could either ask a private sector organization to collect information, or the private sector organization may collect information on their own and divulge it to the RCMP.

[A/Commr Bruce Rogerson]

From our point of view, we determine whether it's evidence or not.

We have collaborations, obviously, with the hydro sector and other major infrastructure industries that have internal corporate security. Yes, if we identify a person who has a certain affiliation with a certain group, we alert them to let them know that they should keep an eye on that individual. They may in fact work on our advice to them.

In this private-public partnership that government is trying to drive—and we're at the table all the time—as one of the concerns they have the private sector people say, “We have all this to offer, and what can you offer us?”

Going back to the original concern, we say it deals with what level of security people have within each industry. Do they meet our top secret—? Can they be held accountable under the secret offences act? That determines how close our interoperability is.

For our part, either we can alert them as to an internal operative who could bring down Hydro Ontario by throwing one switch; or they might say, we're highly suspicious of this individual, who seems to be accessing files within our system that really have nothing to do with their job. So they may gather information, but when it reaches us, we look at it, and that step becomes the footings for us now to ask whether this is an investigative time, whether this is evidence.

The crown prosecutor or the Department of Justice will look at it and weigh whether or not it's admissible or inadmissible, and we flow from that.

But yes, you're correct. If I were an investigator and knew somebody who was working on a bridge and who might want to blow up the bridge between Detroit and Windsor, I would certainly let Transport Canada know—for instance, I'd like you to keep an eye on that person, because they're affiliated with certain groups. Then they would start gathering information for their self-protection.

In the old days, we wouldn't tell the bank the robbers were coming. So the robber would come, go into the bank, put everybody at risk, and leave. Then we'd arrest him outside the door and say, there, we caught you robbing the bank. Now what we do is call the bank to let them know there's a possible—