Information & Ethics Committee on Feb. 22nd, 2007

[Jim Peterson, Liberal, Willowdale, ON]

In effect, your making reporting of significant breaches compulsory is not going to change practice. You are going to look at these on a case-by-case basis. You will be working on an ongoing basis with the institution and you will be working with the private sector to figure out guidelines as to when it will actually be necessary to report a breach.

[Jennifer Stoddart]

That's right, honourable member, yes.

[Jim Peterson, Liberal, Willowdale, ON]

I understand.

Lastly, I'm worried that we're building up a patchwork of laws across the country--the feds and four provinces now, and how many more provinces to come in the future, I don't know.

Do you ever envisage the situation in which we will have a totally harmonized law in order to make compliance easy with all the provinces and the feds?

[Jennifer Stoddart]

I think as we move forward all the jurisdictions will increasingly work together by choice because of the central importance of personal information flow in what's more and more a service economy.

Also, because we're a fairly cohesive group, we look and see what works well in one jurisdiction and what doesn't work well as regulators. I think privacy advocates do that and certainly business does that. So I see that we'll have a common learning experience and we will move to a harmonious....

Yes, did you want to--

[Jim Peterson, Liberal, Willowdale, ON]

It would sure make compliance a lot easier.

[The Chair, Liberal, Tom Wappel]

You're over your time.

[Jim Peterson, Liberal, Willowdale, ON]

Oh, sorry, excuse me.

[The Chair, Liberal, Tom Wappel]

Did you want to add a comment, Madam Black?

[Heather Black]

I did. When Parliament enacted PIPEDA, they anticipated the possibility that we could wind up with a patchwork, and that's why the provision for “substantially similar” is in there. It's an attempt to guide provinces towards some sort of harmonization.

Although when you look at the B.C. and Alberta laws that were passed subsequent to PIPEDA, and on the face of it they appear different because they're different drafting styles and they didn't go with the code and all of that stuff, nevertheless all of the principles in the CSA code are embodied in those two statutes. So they are in effect the same. They have minor differences but essentially operate the same way. I don't think business has a lot of trouble complying with all three.

[The Chair, Liberal, Tom Wappel]

Thank you.

Before we go to Monsieur Vincent, just so I'm clear, and the commissioner is clear, the issue of work product was addressed by IMS and a number of witnesses. In fact a number of witnesses, including the Insurance Bureau of Canada, recommended that we adopt the British Columbia model of work product.

I'm afraid it isn't as limited as you indicated, Commissioner.

[Jennifer Stoddart]

Mr. Chairman, may I reply? I don't think I said one witness. I think it is centred around particularly one issue, which is prescription habits, and also, in the case of the insurance industry, on issues of access to doctors' opinions of people they evaluate for insurance purposes. So I remain--

[The Chair, Liberal, Tom Wappel]

That's at least two issues.

Thank you.

[Jennifer Stoddart]

Okay.

[The Chair, Liberal, Tom Wappel]

Good morning, Ms. Lavallée. You have seven minutes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you very much, Mr. Chairman.

I believe that seven minutes will not be enough for me to ask all the questions I have.

First of all, I would like to thank you both for being here this morning. I think this will be a very significant meeting.

As I said, I have a number of questions and I don't know with which I should start since they all seem very important to me.

First of all, Mr. Peterson talked about harmonizing and combining all the legislation. If I may, Mr. Peterson, I would like to say that I do not really agree with you. In my view, the provinces sometimes go much further than the federal government. Quebec in particular is frequently a leader in many areas, and I cannot envisage a situation where we would have to be subject to the dictates of Ottawa.

Moreover, the issue of work product was mentioned by a number of witnesses. Representatives of IMS Health Canada even suggested a particular wording. What would the repercussions be if we were to pass the wording suggested by IMS? Have you read that wording?

[Jennifer Stoddart]

Yes.

I would refer you to the brief we submitted. I believe this is a very significant act. First of all, I'd like to point out what we seem to be forgetting—the current interpretation creates an exception, and implies that PIPEDA does not apply to the situations envisaged by IMS.

Thus, in the interpretations, we recognize the issue of work product where information—in Quebec—is considered personal professional information. We believe that it would not be a good idea to amend the act, given that the status quo is already the goal we seek. Amending the act, which took years of discussion to craft, would be very significant indeed.

If you were to amend the act, you should examine all the circumstances in which the amendments would be required. You should also examine all the possible implications of the amendments, particularly worker monitoring and intellectual product monitoring in other fields, and with people other than physicians or health workers.

I would repeat that, in my view, the status quo already establishes that such situations are not covered by PIPEDA.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

So, if I understand you correctly, the IMS definition would have to be submitted to other groups, such as groups that look after artists' copyright, to see whether it would result in any unintended effects.

[Jennifer Stoddart]

You could do that, that would be one idea. However, you do not need to adopt this amendment, because the way in which the act is interpreted at the moment means that doctors' prescriptions are not covered by the PIPEDA. Consequently, why pass the amendment?

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I see.

[Jennifer Stoddart]

If problems are identified, they will have to be dealt with. This has not been a problem, because these prescriptions are actually exempt from the act.

We have identified quite enough problems that led us to ask for amendments to the act. There is a case before the courts—I believe there has been a discontinuance—in which the point was made that in this specific case and in light of the facts of the case, these practices were not covered by PIPEDA.

So I fail to see why you would pass an amendment, if this has not been a problem to date.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

It is probably because IMS wants to be doubly sure—to wear both a belt and braces.

[Jennifer Stoddart]

That may be it.

What concerns me is that there be at least a belt. But in many cases, under the act, Canadians do not even have that much protection.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Indeed, particularly with respect to the Patriot Act, which you mentioned earlier. It is quite reasonable to fear that the American legislation may have a very significant impact in Canada and Quebec. Earlier you were saying that under the current legislation, you could manage to ensure that the personal information of Quebeckers or Canadians was protected from the Patriot Act.

What did you mean exactly?

[Jennifer Stoddart]

No law can protect the personal information of a citizen who is outside the country. All countries have the authority to govern what goes on within their own borders. In light of the importance of trade in the Canadian context and the many situations that could arise, the idea is to find a solution that can be adapted to various situations. I think the solution provided for in PIPEDA is that anyone who exports the personal information of Canadians must require that the person to whom the information is sent, even if he or she is in a different country, will comply with Canadian standards. In Canada, that individual is responsible for what happens. This is handy, because if there is a problem with my information in the United States, for example, and if I have these contracts, I have some recourse in Canada, which is more realistic.

I think that when the Quebec law was amended recently, a standard was introduced whereby data are to be exported only if care is taken to ensure that local standards apply to the export of information.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You have said if a Canadian company located in Canada exports personal information, there is some recourse. Who has this recourse? Were you referring to the commissioner or to the individual citizen in question?