Information & Ethics Committee on Feb. 22nd, 2007

[Some hon. members]

Oh, oh!

[Mike Wallace, Conservative, Burlington, ON]

—because I can't understand a word she said other than that.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

That's one, zero!

[The Chair, Liberal, Tom Wappel]

Are you done?

[Mike Wallace, Conservative, Burlington, ON]

Yes.

[The Chair, Liberal, Tom Wappel]

Okay, we're going to round three, and I'll start the round.

Then we have no one on the Conservative side, so if somebody wants an opportunity...and then we have Monsieur Vincent.

I have three questions.

Number one, did I understand you correctly, Commissioner, in your opening remarks to say that the act hasn't been around long enough for you to have a chance to use all of your powers yet? Did you say that?

[Jennifer Stoddart]

I did.

[The Chair, Liberal, Tom Wappel]

Okay, what powers have you not used?

[Jennifer Stoddart]

There are many issues that I've not been able to explore before the Federal Court--for example, the issue of damages. Interestingly, with a lot of foresight, the law provides for damages. I have not yet had a case in which there was a provable amount of damages that wasn't settled beforehand, where I could go to court to see how PIPEDA can help remedy Canadians' actual damages for privacy.

I have a power to do audits on private sector corporations, when I have reasonable grounds to believe that there may be a problem. That is being challenged by one organization. The hearing before the court has not yet come up, so I don't know the extent of this power, which I would argue is an important power.

There are many things, including penal clauses in the act that have not been used. They're not necessarily for me, so I'm just saying that in response to the issue about the commissioner not having power, there is quite a bit of power foreseen in the act, and we should look to see how these powers can be applied before moving to another model.

[The Chair, Liberal, Tom Wappel]

Thank you.

The second issue is solicitor-client privilege: Blood Tribe.

Your note is good, thank you. Also, thank you very much for your paper and your comments. They are very helpful.

[Jennifer Stoddart]

Yes, the staff does that.

[The Chair, Liberal, Tom Wappel]

Yes, but they have direction.

This is not numbered. I guess this is point number 1 in your thing, and I quote: “This decision leaves a gap in the Commissioner's powers and will potentially allow” a broad claim of solicitor-client privilege over corporate-held documents to inhibit an OPC investigation, “with no possibility of independent verification” of the appropriateness of the solicitor-client claim, “other than through a formal application to court”.

What's wrong with a formal application to court, for a court to decide whether or not solicitor-client privilege has been lawfully claimed? With no disrespect to your office, I would think that a judge has the expertise and legal training to make that determination better than your office does.

My question is what's wrong with that? Is your concern that it would take too long for a decision to be made on this very specific issue? If so, and if that's the only issue, why can't you make an immediate application to the Federal Court to determine whether or not this particular claim for solicitor-client privilege is lawful? That is the only question.

[Jennifer Stoddart]

This is what we are doing in compliance now with the recent order of the court of appeal. But could I ask the assistant commissioner to answer your question, because she was directly involved in this case?

[Heather Black]

It would be a cumbersome thing to have to go through. It's also unclear to me how we would get ourselves into Federal Court to do this, since Federal Court is not a court of inherent jurisdiction. Without some sort of statutory amendment, I'm not sure that we could even get ourselves there.

[The Chair, Liberal, Tom Wappel]

That's exactly the point. That's why we're reviewing PIPEDA. You could make a recommendation that we put in the statute that if somebody claims solicitor-client privilege, an application should be made to the Federal Court for the Federal Court to determine whether or not that privilege is properly claimed, if you don't think so. That could have been one of your recommendations.

[Heather Black]

That would have cost implications as well.

[The Chair, Liberal, Tom Wappel]

Clearly, as everything does when it goes to the courts.

[Jennifer Stoddart]

To follow up on Assistant Commissioner Black's remarks, Mr. Chairman, we have that power under the Privacy Act. When the federal government claims solicitor-client privilege, we can review the documents only to see whether the privilege rightly adheres to the documents for which there's a complaint. That was not put into PIPEDA because for some reason it seemed to be an issue that was solved at that point. Nobody thought it was a problem, I understand, from the drafters. We're simply asking you to bring our powers on a level with those we already have on solicitor-client privilege for the public sector.

[The Chair, Liberal, Tom Wappel]

I'm going to confess my bias as a barrister and solicitor in that I think one of the most important fundamental freedoms we have is the strength of the solicitor-client privilege in this country on all issues. Quite frankly, I'm surprised that it's in the Privacy Act, and I have no difficulty personally with requiring a court to make a decision as to whether or not the privilege has been properly claimed. I think that's the proper place for that very important fundamental freedom of individual people to be determined, and not--with all due respect and not to you personally--through a commissioner not reportable to the judiciary.

This is my third and last point, and I'll read this directly from our researcher's question because we want to try to get an answer:

With respect to the issue of breach notification, we have received a white paper put out by the Canadian Internet Public Policy Interest Clinic in January 2007. CIPPIC advocates a law requiring organizations to notify individuals when certain breach criteria are met.

Have you had a chance to review that paper? What are your comments about it?

[Jennifer Stoddart]

I think in our written material we say that it's an excellent and very thoughtful paper. Yes, clearly, there has to be a threshold. I gave the illustration earlier in my remarks on when things are lost for 24 hours and so on. You don't want companies to be burdened with every misplaced piece of paper or CD in an office. There have to be threshold requirements for it not to be too burdensome and become irrelevant to consumers and the public too.

[The Chair, Liberal, Tom Wappel]

Thank you very much.

Monsieur Vincent, and then Mr. Van Kesteren

[Robert Vincent, Bloc, Shefford, QC]

Thank you, Mr. Chairman.

To begin with, I'd like to congratulate Mr. Wallace who has admitted today that he understands the commissioner's role.

[Mike Wallace, Conservative, Burlington, ON]

Thank you.

[Robert Vincent, Bloc, Shefford, QC]

Ms. Stoddart, I agree entirely with what you said about police officers, doctors and work products, and when you say that nothing should be revealed. However, I have a bit of trouble with you saying that losing just a single's day worth of information isn't that serious. You don't know who has got their hands on the information. The person may very well bring back the information that very same day, but having the information for just half an hour is half an hour too much. You don't know what the person has done with the information. The individual may have sold it, etc.

I hear my colleagues saying there needs to be a greater focus on small businesses. May I point out, however, that when representatives from the Canadian Federation of Independent Business testified before the committee, they said they provided training to small business operators. Members of the Chamber of Commerce also provide training sessions to small businesses on the legislation. So there shouldn't be any preferential treatment, be it for a small business or otherwise.

In my opinion, small businesses are especially important. A small shop or clothing store may, over the course of the year, have who knows how many clients. How many credit cards pass through their doors? It's especially important for these people to be aware of the importance of protecting the private information they are privileged with.

So on that note, I imagine that businesses should, to some extent, be made accountable under the act. If a small business operator thinks that he or she has lost private information then the client or clients should be contacted immediately. That way they can contact their credit card companies, banks, etc. to make sure nobody else uses their personal information, which may lead to legal hassles for them. Businesses should bear some of the responsibility when information is lost.

If somebody's identity has been stolen and this leads to financial losses or a crime being committed, the industry or the business should be held responsible and pay the individual back.

What's your opinion?

[Jennifer Stoddart]

I agree with both you and Ms. Lavallée entirely. It's indeed extremely important that businesses waste no time advising consumers in a proper manner.

I wasn't insinuating that the loss of one single day's private information was not significant. It's easy to misplace things throughout the course of the day and if you happen to misplace something in your office and are required to notify somebody immediately, I'd be afraid people would become disillusioned and an unbearable burden would be placed on small businesses.

I agree with you entirely on every other point and I would reiterate that we are working with the Canadian Federation of Independent Business in developing a number of training modules. We're currently testing some educational material with small businesses to make sure that they get the assistance they need so they don't break the law.