Information & Ethics Committee on May 3rd, 2007

[The Chair, Liberal, Tom Wappel]

Good morning. I'd like to call the meeting to order.

This is our 44th meeting. Pursuant to Standing Order 81(4), we're considering the main estimates, vote 45, specifically of the Office of the Privacy Commissioner under Justice, which was referred to the committee on Tuesday, April 25, 2007.

Before I introduce our witnesses, there's just a small matter I'm seeking the guidance of the committee on. I presented the report of the committee on our statutory review of PIPEDA yesterday in the House of Commons. About an hour before that, it was brought to my attention that, in the opinion entitled “Dissenting Opinion” of the Conservative members, in the last sentence of section 4.0, under “No Stakeholder Input Before the Committee”, the last sentence reads “Minister Day’s letter is attached as an annex to this dissenting opinion.” When the dissenting opinion was received by the clerk, that letter was not in fact attached. The dissenting opinion was sent to the printer without that letter because it wasn't attached, so this document I presented to the House did not contain that letter.

In addition, if the letter were to be attached, it would exceed the five pages for a dissenting opinion this committee decided upon. I am just inquiring whether the committee would have any objection if, in the 350 copies we're going to print for general distribution, notwithstanding the previous discussions and agreement by the committee, we could agree to simply annex the minister's letter as referenced by the Conservative members in their dissenting opinion on recommendation 14. Would that be all right?

[Jim Peterson, Liberal, Willowdale, ON]

Can we just stick it inside?

[The Chair, Liberal, Tom Wappel]

We'll print it up properly so it's attached.

[Jim Peterson, Liberal, Willowdale, ON]

Are you going to have to reprint 350 copies?

[The Chair, Liberal, Tom Wappel]

No, they haven't been printed. There were only the ones I submitted.

[Jim Peterson, Liberal, Willowdale, ON]

No problem.

[The Chair, Liberal, Tom Wappel]

That's okay for everybody? Then we'll do it that way.

Thank you very much. That takes care of that.

Now we have with us this morning, from the Office of the Privacy Commissioner of Canada, the commissioner herself, Jennifer Stoddart; the director general and chief financial officer, corporate services division, Tom Pulcine; and Wayne Watson, director general, investigation and inquiries branch. Welcome to you all.

I know, Madame, that you have an opening statement, so allez-y.

[Jennifer Stoddart, Privacy Commissioner, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chairman and honourable members.

I do have an opening statement that is being distributed to you, as well as some supplementary information we have prepared, given our past appearances before this committee, to try to clarify some rather complex budgetary points for the honourable members.

Mr. Chairman, with your permission, I won't read my opening statement; all the honourable members do have a copy in both official languages. I'd just like to highlight some points in it and perhaps give the honourable members more time for questions on budgetary issues that interest them.

First of all, I'd like to thank the committee for the report they brought down on PIPEDA yesterday afternoon. It looks like an excellent report, and I see that many of the recommendations we made to this committee have been retained. I thank you for your interest in such practical matters as employment, information rights, due diligence, international cooperation, and so on. However, given that I was out of the office on communication responsibilities yesterday, I haven't had the chance to read it. Also, I will reserve any comments for later.

Once again, thank you for your work on what I know is a very complex topic.

I am here today with regard to the Main Estimates. I first want to say that our top priority continues to be tackling our complaints backlog. Mr. Watson is here with me to answer your questions in this regard, should you have any. We are also putting increased emphasis on education and prevention, as well as leaks and gaps with regard to protecting confidential information.

We are now in the second year of the two-year implementation schedule for our office's comprehensive business plan, and that's why you see we're now in the second set of bars in that graph we have done to illustrate the evolution of our budgetary status.

I'd just like to remind the honourable members of how the environment in which we work is constantly changing because of the technological backdrop to all the work we do, and this accounts for a large part of our work. International data flows have caused us to give increased attention to the issue of international cooperation, and I can mention GPS, biometrics, RFIDs, ongoing security questions--think of the do-not-fly list--the Anti-terrorist Act, and so on.

Our budget is underpinning five strategic priorities we have outlined in the material put before you. I'll just remind you of them. There's improving and expanding our service delivery, that is, answering complaints and requests for information and responding to the communication needs of Canadians and Canadian organizations. There's engaging with you on privacy issues, and I must say I'm very happy to be appearing before you, I think next Tuesday, on the issue of identity theft. I am really happy that you have taken up that issue, and we're busy putting together a presentation for you on Tuesday.

Then there's Privacy Act reform and PIPEDA reform, which you've just dealt with. I understand you may be looking at Privacy Act reform in the fall again, and I really welcome that. We'd be very happy to do whatever would be appropriate and useful for this committee in your study of the Privacy Act.

We are hosting the 29th International Conference of Data Protection and Privacy Commissioners in Montreal in late September. This is a huge international conference. We expect some five hundred people, and it is a kind of convergence of many privacy players throughout the world. There'll be a whole week of meetings on privacy, including on privacy in various provinces, hosted by provincial commissioners. That is clearly our primary focus from here until the end of September.

We're continuing to build our organizational capacity in terms of staffing, training, and structuring our office. Overall, we're trying to become more and more proactive and less complaint-driven, that is, less passive--by waiting for problems to come to us--but rather going out and trying to find privacy problems and bring a solution to them as they occur.

If you are interested, Mr. Watson can give you more specific figures on our complaints backlog. In any case, I want to draw the attention of committee members to the fact that we have ourcut complaint backlog by approximately 50% over the past year. We are very proud of our efforts, and we hope to be able to eliminate this backlog completely by the end of the current fiscal year.

We will of course use many means, including new technology and new procedures, in streamlining the complaint system.

In keeping with our wish to become more proactive and more preventive in our approach, we're increasing the number of audits, and we were funded to support an expanded audit capacity. I think we're doubling the number of audits we're doing in the public and private sectors. You will also remember that we have a new audit responsibility for FINTRAC, our national money laundering agency, and by legislation we audit FINTRAC every two years.

This committee has been particularly concerned about--and I understand has given me directions to enhance--public education, communication, and outreach to Canadians and companies. So I'm happy to say that we have completed an interactive e-learning tool for retailers in conjunction with the Retail Council of Canada and the Canadian Federation of Independent Business. We have a PIPEDA-101 DVD, we're looking at drafting breach notification guidelines, and of course we'll take into account the direction you've given us in your report.

Several other of the priorities for this year include continuing to dialogue with this committee or other committees of Parliament in order to work on fundamental reforms to the Privacy Act. I remind you that the Privacy Act has standards that are far below what we now expect of the public sector, and we'll talk a bit more about this in the fall.

That, Mr. Chairman, is an overview of our priorities, and the budget we hope you will vote for us is in support of those priorities. I'd be very happy to answer any questions on our work or any of our particular projects or our past expenditures.

[The Chair, Liberal, Tom Wappel]

Thank you very much, Commissioner.

Yes, I believe you are scheduled to appear on Tuesday in connection with the identity theft study. I regret I will not be able to be here; I have a commitment in the riding. Mr. Tilson will be taking the chair, but you can be assured that I'll be reviewing your comments. It's a very important issue. We're looking forward to hearing what you have to say, but we'll deal with it Tuesday. Today we're looking at your estimates.

We'll start with Mr. Peterson, followed by Monsieur Vincent and Mr. Martin.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.

In what area are the largest number of complaints you have?

[Jennifer Stoddart]

As a single group?

[Jim Peterson, Liberal, Willowdale, ON]

Yes.

[Jennifer Stoddart]

I stand to be corrected by Mr. Watson, but I would say probably, under the Privacy Act, it's complaints against large information-handling organizations such as Correctional Service Canada, Revenue Canada—these are organizations that touch a lot of Canadians—and possibly the RCMP, as single organizations that are the focus of complaints.

[Jim Peterson, Liberal, Willowdale, ON]

How long does it take you to investigate complaints?

[Jennifer Stoddart]

Most unfortunately, right now it takes us over a year, but it depends on the type of complaint. Some complaints, for example on time limits—that is, complaining that the organization didn't respond in the required time under the Privacy Act—take I think under a year now, so it varies.

[Jim Peterson, Liberal, Willowdale, ON]

In an ideal world, what would that time be?

[Jennifer Stoddart]

Well, again, it depends on the subject matter, honourable member. PIPEDA directs us to answer the complaints in less than a year, and that is certainly our target, to comply with the law. I'd say as fast as possible. Ideally you'd have a turnaround in a couple of months.

[Jim Peterson, Liberal, Willowdale, ON]

In your statement you said the privacy standards of the private sector are higher than those applied to the federal government. Could you just give me a brief indication of how that happens?

[Jennifer Stoddart]

Yes. It sounds like, if we look back, it happens because the Privacy Act has not been reviewed since 1983; the act reflects the state of our knowledge about personal information protection in the early eighties. PIPEDA was drafted in 1999-2000 and reflects a more modern understanding of what it takes to protect personal information.

One example, honourable member, is the fact that the Privacy Act only allows Canadians to look at or have access to the personal information holdings the government or a government agency has on them. It doesn't give them a right of correction or even a right of redress. Consumers have both of these under PIPEDA.

[Jim Peterson, Liberal, Willowdale, ON]

Thank you.

When do you think your backlog will be resolved?

[Jennifer Stoddart]

Our goal is to do it over the course of the coming year.

[Jim Peterson, Liberal, Willowdale, ON]

Do you believe you can achieve that with your current budget?

[Jennifer Stoddart]

The budget is not a problem, honourable member; we're happy with our budgetary levels. Our challenge is demographics. It's hiring the employees to do that job. There are several reasons I could give you for the scarcity of qualified employees.

[Jim Peterson, Liberal, Willowdale, ON]

Why would that be?

[Jennifer Stoddart]

There are a couple of reasons. First of all, we have a cohort of skilled investigators who are retiring. They've been there for twenty years and so on, and some of them are taking retirement. With all the developments in the federal public service—you could think of Bill C-2 and so on—there is a growing need for investigators in the federal government, so several agencies are competing for people with investigator skills.

There is also the problem of our being a small agency, which tends to mean that people who want promotion are attracted to larger departments where they can proceed up the promotion scale. Some of our able people move on to well-deserved promotions elsewhere that we can't give them because of our size. All of that means we're 40% understaffed in the investigation area.