Information & Ethics Committee on Feb. 22nd, 2007

[Robert Vincent, Bloc, Shefford, QC]

Do you believe that encouraging small and large businesses to compensate those individuals whose personal information they lost is enough to get them to consider that the personal information they have in their possession has to be dealt with as carefully as if it were their own?

[Jennifer Stoddart]

I think it is a very important incentive. The public is very concerned by all this. Perhaps you watched La Facture last week. This is not the first time that the media has dealt with this phenomenon. We all are very concerned. People are feeling a bit paralyzed. It is very important that people have tools and take action to counter this phenomenon. We have to have the authority to act. The message for businesses is clear: under such circumstances, you have to notify people and tell them what you will do. But I think that things are not that clear at present.

[Robert Vincent, Bloc, Shefford, QC]

Should those incentives not be included in the act, that is to clearly state within the act that all lawyer's fees and costs related to the loss of personal information should be paid by the industry? Could we not include something so that everyone understands?

Both small and large businesses do not take the Privacy Act seriously. I have seen insurance companies sharing information about people who had been involved in car accidents. People from one insurance company would call up staff from another to find out whether a certain individual had already had a car accident while covered by that company. They gladly share personal information. I am not sure that they take serious care of the personal information in their possession.

[Jennifer Stoddart]

PIPEDA, which you are currently reviewing, already contains a compensation provision. I was talking about it with the chair earlier on. It is possible to obtain compensation. We have raised the issue, and up until now, all businesses have settled their problems out of court. The act therefore does cover such incidents.

Now, when there is a breach of contract or loss of personal information, we want consumers whose personal information is being held to be notified. I think that notifying consumers and businesses would help greatly.

[Robert Vincent, Bloc, Shefford, QC]

Could we not have...

[The Chair, Liberal, Tom Wappel]

Mr. Vincent, your time is up. Thank you.

Mr. Van Kesteren, you have seven minutes.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Madam Commissioner, I want to talk about spam for a minute. In your submission you said that none of the task force recommendations has been implemented. Wouldn't you agree that some have been adopted by businesses? I'm thinking of the “Stop Spam” website, the volunteer organizations for businesses and organizations to protect their personal information. Isn't that working? Can you just briefly comment?

[Jennifer Stoddart]

Yes, there is a concerted effort on the part of the private sector and the police to deal with spam as a vehicle for fraud. In fact, in a couple of days it's going to be March, Fraud Awareness Month, and we are going to be very active in that along with many law enforcement agencies, important agencies like the Competition Bureau, the chambers of commerce, and so on. We are all doing our best--

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

The government is backing that.

I'm sorry to interrupt.

[Jennifer Stoddart]

That's not directly the government. There are government agencies involved in that, yes, you are right. There was a fairly important task force--there were many specialists on this task force--that suggested we have some specific anti-spam legislation. Most of the G-8 countries—I give the statistics in my letter—do have such legislation, and specific measures would help us to fight spam. That's what I wrote the minister about as Fraud Awareness Month approaches.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

You mentioned that this committee ought to focus on spam. We're conducting a review of PIPEDA. In the report on spam, don't we make any recommendations for any specific changes to PIPEDA already?

[Jennifer Stoddart]

There were some suggestions for minor changes, but we're not suggesting that PIPEDA be amended wholesale to deal with spam. It's not perhaps the most appropriate vehicle, but I am presuming on this committee's mandate for privacy—this is the House of Commons committee on protection of personal information—to draw to your attention an associated problem that didn't exist, and I don't think it existed really, in 2000 when PIPEDA was created. In the lives of many consumers--and I don't know about you, but we receive a lot of spam--this is a huge threat to our personal information, and it carries fraud implications.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

How has your office stepped up its enforcement since the report? Have you stepped up enforcement against spam?

[Jennifer Stoddart]

As Assistant Commissioner Black explained, it's not something that with our existing powers we're really set up to deal with because it takes strong penal criminal powers, but we have stepped up our cooperation on Fraud Awareness Month. Six years ago I'm not sure that existed, and each year that goes by we are playing a bigger and bigger role. You will see a press release. I brought this up at the recent federal-provincial privacy and information commissioners meeting in Banff. You will see some concerted action on the issue of fraud awareness on the part of all the commissioners across Canada. Yes, we are stepping up our education efforts tremendously.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I don't think it's been addressed yet, but one of the suggestions by some of the groups was that you should have more teeth. How do you feel about that? I know that when you first came here we all felt, and I agreed, that it's in the best interests of banks and insurance companies and the larger corporations to apply these practices, and you felt that exposing them or making the public aware of breaches would be a deterrent. What do you think about some of the suggestions that you should have more teeth and that there should be fines or things like that in your power? How do you feel about that?

[Jennifer Stoddart]

I respect the opinions of those who suggest that to you. They're looking at other enforcement models that work very well in that context. But I'm saying to you that given the recent history of the Office of the Privacy Commissioner, and given also that we're not a one-off creature, rather we're linked in the interpretation of our act to the Access to Information Commissioner and to the role of other agents of Parliament, if you look at that and you look at the powers I have, particularly under PIPEDA, I have quite a few teeth as it is. There's been a lag in maybe baring those teeth because of those reasons, but the law has quite a few teeth.

Where I need more teeth is in the Privacy Act, but that's not the subject for today. I need a full set of dentures for the Privacy Act.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Mr. Peterson.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.

Ms. Black, in response to Mr. Pearson, you said there were very few ISPs that we had to be concerned about. We heard testimony that there are well over 100 or so. I just want to clarify--

[Heather Black]

There are a lot of small ISPs, yes, but the majority of Internet services are provided by essentially a handful of companies in this country, a huge proportion.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.

Ms. Stoddart, if we were to choose, as a committee, to adopt the B.C. model for defining work product, would that cause you problems? If so, what would these be?

[Jennifer Stoddart]

We've addressed this issue that we are hesitant to recommend that you move to that because the interpretation, perhaps not necessarily by us but it's a direction to the courts as well, could spill over into many areas that we can't foresee at the time and could have an impact on the general issue of worker surveillance, which is a huge issue. Between voice prints, GPSs, biometrics to get in the door, surveillance videos at your work and so on, this is a huge issue for all of us. I would be concerned with the additional direction that it would give me in that context.

[Jim Peterson, Liberal, Willowdale, ON]

Were we to adopt it, would there be a way to deal with the concerns you just expressed and yet bring a greater amount of certainty to the question of what work product really is?

[Jennifer Stoddart]

If you chose to suggest that, perhaps I could look at it in that light and make some suggestions at that point.

[Jim Peterson, Liberal, Willowdale, ON]

Good. Thank you.

[The Chair, Liberal, Tom Wappel]

Mr. Vincent, you have time for a short question. We will then move on to Mr. Stanton.