Information & Ethics Committee on Feb. 22nd, 2007

[Alan Tonks, Liberal, York South—Weston, ON]

Okay, then, who makes a decision or an adjudication as to whether it goes beyond the provisions in PIPEDA, which are, you said, that right of access? Your role is to determine where privileged information is being abused by Elections Canada, let's say. Who adjudicates on that?

[Jennifer Stoddart]

The whole administration, the legality of the Elections Act, however it may be modified, is the responsibility of another officer of Parliament, who is the Chief Electoral Officer. It's very hard to see how it would be linked with PIPEDA, which is the private sector legislation.

There's another parallel act, the Privacy Act, which would apply to any public sector privacy issues that might arise. I don't know that my office has ever been involved in any electoral investigations.

[Alan Tonks, Liberal, York South—Weston, ON]

Fair enough. Thank you.

With respect to what you described under investigative powers, I have a quote that you were concerned with respect to blanket consent and that we don't get into--I'll actually use the quote--“fishing expeditions” and “open season”. Those are fairly rhetorical terms. Are you satisfied, within the mandate of PIPEDA and your role, that there is a balance with respect to the private sector and the checks and balances that protect the individual? In your role you have the authorities to use discretion.

[Jennifer Stoddart]

As it turns out, this is more, I suppose, of a theoretical than a real question. We raised it in our initial consultation paper, Mr. Chairman, that we distributed this summer. We found that the majority of respondents--we had 62 responses, I believe--were not really interested in this issue or really didn't have much to say about it. I think there hasn't been much testimony about it before this committee. So we're saying at the moment this is not an issue that we would advise this committee to pursue, given the importance of some of the other issues. It's a question we'll continue to ask ourselves on a case-by-case basis: was there a valid consent, given the context in individual cases?

[The Chair, Liberal, Tom Wappel]

Thank you, Mr. Tonks.

Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chairman. I have a few more quick questions.

On the notification piece that you're asking for, in terms of it being strengthened, I want to be clear that you're still not asking for order-making powers. You still want to be an ombudsman in this sense. But adding that authority to force people to notify, is that not giving you order-making powers? I'd say it's not because it's not a financial penalty. Is that correct?

[Jennifer Stoddart]

No. Order-making powers means that the conclusion you get to is directly enforceable in law. We do have powers, but we have to go to the Federal Court and prove our case to have these powers.

[Mike Wallace, Conservative, Burlington, ON]

So you're happy with the way it is now. You'd like to continue that process.

[Jennifer Stoddart]

That's right.

[Mike Wallace, Conservative, Burlington, ON]

You were having a conversation with Madame Lavallée and, if I caught it correctly, you talked about working on the voluntary notification piece.

[Jennifer Stoddart]

Yes.

[Mike Wallace, Conservative, Burlington, ON]

It's great that you're working with that organization for a voluntary code of conduct. But doesn't that really exist already in your office in a sense? Isn't there a voluntary system by which they call you and you advise them on how to do it? Doesn't it exist?

[Jennifer Stoddart]

Yes, some of them call us, but we don't know about the ones that don't call us. It's clear to me as Privacy Commissioner that when this happens it's maybe not clear enough to all corporations exactly what they should be doing. I'm in favour of guidance, while waiting for the amendments to be passed, hopefully. I'd be happy to work on guidelines, so it's very clear when this happens they know what they should notify people about, and that's what Madame Lavallée was suggesting. What are the implications? What are the details? What's the template? Who should be notified? Who should people call? What should they do?

[Mike Wallace, Conservative, Burlington, ON]

I completely understand your role. You're here to protect privacy. You're the Privacy Commissioner and with you is your assistant commissioner. Privacy is your issue. From my end of the table, there has to be a balance between security and privacy in today's environment, whether it's a great thing or not. And to be frank with you, and I know Robert agrees with me, “lawful authority” might be a difficult thing for them to explain. The “may” issue and “authorized” to provide it, I think in terms of wording, aren't a huge change but may help police in describing it.

Just give me an example. We've used this terrible example of the ISP user. We were told there are a thousand ISP providers and about 30%...that's 300, not a few. Now there are a few big ones, but they're small and they may be our problem.

Let's use another example, and tell me if I'm wrong, because I just don't know and I'd like to know this before I make any decisions on it. I own a company that produces guns, for example. I have a customer who happens to be buying guns lawfully but selling them to a group that's on our terrorist list. The police want to know whether that person is my customer. Am I entitled, as the owner of that company, to tell them, based on the law? Do they have to explain to me that I may tell them or I may not? Do you think “authorized” to provide it would help that situation or not, or do you think they really need a warrant to find out whether this person is my customer?

[Jennifer Stoddart]

The paragraph is permissive. So it's their judgment that if this is something direct, they somehow know that this person is on the terrorist watch list and buying guns.

[Mike Wallace, Conservative, Burlington, ON]

I don't know where he's selling the guns, but he's buying a large amount of them. It's legal and he is entitled to do it.

[Jennifer Stoddart]

It's their choice; that's what we're saying. In 2000, this choice was already put in.

[Mike Wallace, Conservative, Burlington, ON]

If we change it to “authorized to provide”, is that damaging?

[Jennifer Stoddart]

Yes, because any information that the police or national security forces would want would almost have to be provided. We have a court system for this, and if it's that serious, my position is, why don't you go before the courts?

[The Chair, Liberal, Tom Wappel]

No, they would either have to have a warrant or lawful authority—not any information that they want.

[Jennifer Stoddart]

They say they have lawful authority in terms of—

[Mike Wallace, Conservative, Burlington, ON]

I'm convincing Mr. Vincent that he's going to vote for--

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Just for your information, Mr. Chairman, I'd like to point out that a gun registry would be a perfect way of achieving this.

[Some hon. members]

Oh, oh!

[Mike Wallace, Conservative, Burlington, ON]

Thank God for translation--