Information & Ethics Committee on Feb. 22nd, 2007

[Jennifer Stoddart]

In fact, our recommendations cover the issue of police obtaining information, but our suggestions are, perhaps not unexpectedly, opposite to the direction that the police recommended to you yesterday. We would like to go back to the pre-Public Safety Act version of PIPEDA.

PIPEDA, as it was passed by this Parliament in 2000, did not make into private companies, through extraordinary powers, prolongations of the state's ability to collect personal information without consent for the purposes of law enforcement and national security. This is a major change in a democracy. It's basically giving private organizations powers akin to that of the police. I protested against it when it was passed in 2004; I keep that position.

The police are concerned whenever they can't get information, and they are concerned that PIPEDA has raised privacy consciousness in many Canadian organizations. These organizations ask, under section 7, if they should be doing this--if they should be handing over this employee information if the police come knocking. This article says they may or they may not, so they are considering it. We think this is quite far enough for law enforcement purposes, and it's discretionary.

As Privacy Commissioner, I have to remind this committee that personal information is part of a person's basic rights as a citizen, as a person. The police should be required to go before the courts if they have serious doubts and serious suspicions and need to get people's sensitive information. Surely our Canadian courts can look at what the police record is--they should not go on fishing expeditions through people's places of work, for example.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Do I have a little more time, Mr. Chair?

[The Chair, Liberal, Tom Wappel]

You have one minute.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Like Mr. Pearson, I have smaller businesses as one of my biggest concerns. It became evident very quickly that PIPEDA seemed to be more of an issue with larger corporations than with smaller corporations. In terms of cost, can your office give us some detailed information? We're looking at the small multinationals versus the small businesses. Are we going to have an enforcement problem? I really see that as a looming area of concern--that we are putting big business requirements on small businesses.

On your end of the stick, are we going to have an enforcement problem? Can we have some type of cost analysis breakdown as to what it is going to cost to enforce?

[Jennifer Stoddart]

Do you mean in terms of data breach notification?

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

In all these recommendations.

[Jennifer Stoddart]

I think the cost to our office is minimal, but we could certainly cost out if, as we suggest, corporations had to notify us. Certainly, we have to have some type of notification reception mechanism, and that could be an additional cost, but I'd think it would be minimal in the budget of the Privacy Commissioner.

To come back to your--I'd say appropriate--concern with the cost for small businesses, we have been working with the Canadian Federation of Independent Business. We are rolling out special modules for small businesses. We are testing these modules with members of small business because we are very conscious of not trying to impose additional regulatory burdens on small organizations.

In our experience too, the challenge in applying this law is not with small businesses, because they are anchored in the community. As we become more privacy conscious, if your local business messes up with your personal information, I think there will be community pressure. They'll do it once and they'll learn spontaneously. Each community business doesn't have the amount of personal information that huge multinationals do.

My concern as Privacy Commissioner is not the possible danger from small businesses that are doing their best--and we're trying to help them and we're in constant contact with their associations--but the huge amount of data that is pooled in large organizations where one spill can affect possibly millions.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you.

[The Chair, Liberal, Tom Wappel]

Just to be clear, so we're not talking about apples and oranges and so the committee is clear, your concern on the security issue is paragraph 7(1)(e), which was added by the Public Safety Act. Is that correct?

[Jennifer Stoddart]

Yes, it is.

[The Chair, Liberal, Tom Wappel]

You want the act to go back to the way it was, which, as I understand, included subsection 7(3), including paragraph 7(3)(c.1), which was added by the committee.

It's paragraph 7(3)(c.1) that the RCMP addressed, not paragraph 7(1)(e).

[Jennifer Stoddart]

That's right.

[The Chair, Liberal, Tom Wappel]

Do I take it then that you have no problem with subsection 7(3), and in particular paragraph (c.1), remaining in the act, since you're calling for it to be pre-Public Safety Act?

I guess Mr. Van Kesteren then was really asking about your comments on paragraph 7(3)(c.1) that the RCMP and others commented on, namely the words “may disclose”, for example, and the meaning of “lawful authority”.

I'm not going to take up other members' time. I just want to be clear on what we're talking about.

[Heather Black]

Right.

[The Chair, Liberal, Tom Wappel]

If you want to address that later to someone else's question, possibly mine, we'll do it.

[Mike Wallace, Conservative, Burlington, ON]

I'll probably ask that question.

[The Chair, Liberal, Tom Wappel]

We'll now go to Madame Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you.

I will come back to my wonderful question. There are some companies that are responsible enough, including those that deal with mutual funds. For the moment, legislation does not require that businesses notify clients. A friend of mine received this type of letter. I do not know if he has the same mutual funds as Mr. Wallace. In the letter, that I saw with my own eyes, this person was told that they simply wanted to let them know that they had more or less lost their personal information, but that the risk due to the loss was not very high.

Nothing is very clear. We are not aware of the consequences of the loss, nor of the theft of which they were a victim. People are not quite sure what to do either. Mr. Wallace decided to throw his notice into the garbage, but some people filed that information in their heads under worry and anguish.

Do you not believe, Ms. Stoddart, that the legislation should oblige all businesses to notify their clients, according to reasonable conditions? I know you put forward some proposals in your document. Let us presume that the consumer's financial security is at stake, that the risk is serious enough. I know that you have the necessary resources to identify such situations. Do you not believe that first and foremost, there should be a duty to notify the client? In this notice—and it would be a good idea to have that formula drafted by the people in your office—the risk that the consumer in question is facing could be clearly set out, along with the lost or stolen information. I think that the client should know that. It is not enough to tell him that a little problem has cropped up.

There should also be the possibility of some remedy. You mentioned that in Quebec, it is possible to launch a class action. The fact remains that the legislation we are discussing here was designed for the consumer who receives this kind of letter at home. When one considers a class action suit, it is not easy to know where to begin. The business should be responsible for specifying the type of remedy. It should also—and it was one of our witnesses that put forward this suggestion, which I found interesting—compensate in whole or in part the damages that were caused. How could that be done? By taking certain steps itself, for example by sending out the kind of fraud warning to businesses that collect credit information. Indeed, taking those kinds of steps themselves represents a lot of work.

In short, should businesses not have that duty?

[Jennifer Stoddart]

I more or less agree with what you have just said. That is what the overview of the situation of the jurisdictions who took such steps indicates.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

And they even talk about compensation for the damages caused?

[Jennifer Stoddart]

Mr. Chairman, we still don't fully understand the link between the loss of personal information and any potential damage this may cause, for example. However, I completely agree with statements made in relation to fixing any such damage.

We also need to work out whether businesses losing such information should be penalized in some other way. For the time being, we're telling you that those unrestricted individuals must be fully apprised of the details, as you suggested.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

That process will be based on the model you're developing, correct?

[Jennifer Stoddart]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Otherwise, we run the risk of ending up with all manner of weird and wonderful permutations.

[Jennifer Stoddart]

A specific model is being recommended to businesses. To give you an example, you have to indicate what occurred; when the loss took place; the type of personal information involved; a fairly precise summary indicating the risk of fraud; advice to individuals as to how to better protect themselves; steps the company needs to take; people who can provide any further assistance; the challenges associated with getting this information out to people, by mail, for instance, given the problem of junk mail with e-mailing, for example.