Thank you, Mr. Chairman.
I apologize for not having my remarks to distribute. I was notified on Friday of the session. I wrote diligently over the weekend, but I didn't have a chance to have it translated.
I thank you for your patience in letting me read my statement into the record.
I'm not able to offer evidence about the specific disclosure of Mr. Jim Bronskill's identity to operational officials, and a number of government organizations, or to exempt staff in the Prime Minister's Office. Apart from seeing a copy of the e-mail minutes of a meeting in which the disclosure of Mr. Bronskill's identity was made, a copy sent to me by a journalist--not by Mr. Bronskill, who had received a copy of the e-mail in response to an access request--I know no more about this particular incident than do the members of this committee. My office has not received a complaint about the matter, and the matter, as I understand, is under investigation by Mrs. Stoddart, the Privacy Commissioner. The Office of the Information Commissioner welcomes that investigation and looks forward to having the benefit of her findings and recommendations in due course.
On the more general issue of the importance of protecting the identities of access requesters from dissemination within government, I will make a few observations. My starting point must be the unanimous decision of the Supreme Court of Canada, written by Justice Gonthier in 2003 in the case of the Information Commissioner versus the Commissioner of the RCMP and the Privacy Commissioner.
Justice Gonthier, for the court, said this:
s. 4(1) of the Access Act provides that every Canadian citizen and permanent resident “has a right to and shall, on request, be given access to any record under the control of a government institution.” This right is not qualified; the Access Act does not confer on the heads of government institutions the power to take into account the identity of the applicant or the purposes underlying a request. In short, it is not open to the RCMP Commissioner
--and, may I add, to any head of institution--
to refuse disclosure on grounds that disclosing the information...will not promote accountability; the Access Act makes this information equally available to each member of the public because it is thought that the availability of such information as a general matter is necessary to ensure the accountability of the state and to promote the capacity of the citizenry to participate in decision-making processes.
At tab 1 of the information I've handed out to you, I've included a copy of that decision of Justice Gonthier. If you're interested in looking up what I've just quoted, that paragraph is on pages 24 and 25 of the English and pages 26 and 27 of the French version.
Those strong words from the Supreme Court of Canada give us these unambiguous messages.
One, in order to make decisions about whether or not to disclose information requested under the Access to Information Act, it is neither necessary nor appropriate to take into account the identity of the access requester or the motivations of the requester.
The second unambiguous lesson is that the reason identities and motivations ought not be put into the decision-making mix is that the right of access must be afforded without discrimination to all if the purposes of the act are to be realized.
The third message is that the purposes that are at stake go to the very heart of a healthy democracy. They are to ensure the accountability of the government and to promote the capacity of the population to be informed and knowledgeable participants in our democratic institutions.
The current law of Canada restricts the disclosure of requests for identities to the use for which the identity was provided or uses consistent with that purpose.
If you look at tab 2 of the materials, you'll see sections 7 and 8 of the Privacy Act. I'll take you to section 7:
Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except
(a) for the purpose for which the information was obtained or compiled by the institution or for use consistent with that purpose;
Section 8 has a similar limit on disclosures of personal information. The name of an individual access requester is personal information. This is enshrined, the need-to-know principle, with respect to the identity of access requesters. The identity of an individual access requester may be used or disclosed without the consent of the individual only for the purpose of processing and answering the request.
For example, the $5 cheque that comes with an access request will be sent to the institution's finance department. In so doing, the finance department will learn the identity of the access requester. That disclosure is permitted. And the request will be assigned to an ATIP analyst, who will send the acknowledgement in reply and who may communicate with the requester to clarify the request, or transmit a fee estimate, or collect a deposit, or to notify of an extension of time and so forth. Disclosure of the requester's identity to the ATIP analyst is necessary to process the request and hence is permitted.
Beyond the ATIP and finance units and perhaps to legal services if there is a need to verify the eligibility of the requester to make a request, generally speaking there is no need for any other government official to be given the requester's identity without the consent of the requester. There is no need, for example, for those searching for the records to know the requester's identity; there is no need for those assessing the likelihood of harm from disclosure to know the requester's identity--that was made clear in the passage I read from the Supreme Court of Canada--there is no need for the public affairs group to know the identity in order to prepare the minister and department for any questions that may arise from the disclosure of the requested records; there is no need for any senior officials in the approval chain, including the minister, the Prime Minister and exempt staffers, to know the identity of access requesters.
What I have described is the legal protection that now exists in the Privacy Act for the identities of individual access requesters. However, there is in statute law no protection for the identities of access requesters who are legal persons rather than individuals. Corporations, NGOs, partnerships, and associations are also frequent users of the Access to Information Act. Businesses make up the largest user group--far more frequent users than individuals such as journalists, MPs, or academics.
That is why in the open government act that was tabled with this committee last fall, it is proposed that the Access to Information Act be amended to include specific protection for the identity of all access requesters. And if you look at tab 3 in the materials I've circulated, and if you look to subsection 4(5) on the second page, the proposal is that:
The identity of a person making a request under subsection (1) may not be disclosed without the consent of the person unless
(a) the disclosure is solely within the government institution to which the request is made; and
(b) the person's identity is only disclosed to the extent that is reasonably necessary to process and answer the request
This provision did not make its way into Bill C-2, the Federal Accountability Act. However, Bill C-2 establishes a duty to assist access requesters without regard to their identity. While this new obligation is positive, it does not restrict the dissemination of requester identities. The Office of the Information Commissioner encourages the government to include the above-quoted open government act provision in any Access to Information Act reform bill it may bring forward.
Improper disclosures of requester identities can no longer be convincingly blamed on ignorance. The Treasury Board has issued guidance on this matter to all departments. And if you look at tab 4 of the materials I've issued to you, at the second page you'll see guidelines on treating the identity of a requester as personal information.
Reports have been made by information commissioners, government training programs remind officials not to disseminate requester identities, and the government's task force on access reform of 2002 reminded public officials of the need to protect the identities of access requesters. The reason for all of this is intuitively known to every public servant, elected official, and exempt staffer. Requester anonymity is necessary to ensure impartiality in the processing of access requests.
We have seen the effects of unnecessary disclosure of requester identity. One is retribution, such as loss of contracts by businesses, loss of access to the Prime Minister's aircraft by journalists, or career retaliation against employees. We have seen threats and bullying--for example, senior officials communicating directly to the access requesters their displeasure at being the targets of access requests. We have seen discriminatory treatment of the access request itself by it being improperly delayed, subjected to inflated fee estimates and 100% deposit demands, refusals of fee waivers, and overly broad application of exemptions to deny access.
In the hand-out, I have included materials that describe a case where disclosure of a requester's identity had some of these adverse effects. If you look at tab 5, that abstract from an annual report of the Information Commissioner had to do with a deputy minister-level official in the Government of Canada who was on secondment to the Tobin government of Newfoundland to help negotiate the Voisey's Bay nickel project. His former department, Fisheries and Oceans, had received access requests about him. You'll see on page 23 that the deputy minister, Mr. Rowat, wrote a letter to the access requester, and the letter said:
It has come to my attention that you and/or your organization are collecting a comprehensive file on my personal and professional activities. Will you please: - notify me in writing if, in fact, you are preparing a file, which in any way concerns me. - If so, advise me of your intended purpose and use of that information. - Provide me with a copy of all current information you have in your files that pertains to me. - All requests or approaches you have in train to collect information on me and my activities, and provide me such information when it is received by you. I am providing a copy of this letter to the Canada Privacy Commissioner.
As you can imagine, the access requester found that to be rather intimidating. The full report, which involved litigation when the official refused to answer the question of who gave him the identity, is set out at that tab.
It has been our experience that this is a very difficult wrongdoing to satisfactorily investigate. It usually happens in oral communications, or by means of easily disposed of post-it notes on ATIP files. It usually happens among officials who are fully aware that their curiosity about identities is improper, hence there is little tendency to come clean under questioning.
ATIP coordinators are in a no-win position. The senior officials who want to know requester identities are those who decide the coordinators' career futures. Yes, there are some individuals with the strength of character to say no to superiors. But let's be realistic, that kind of courage is bound to be the exception, not the rule.
On our prescription, first pass the provisions previously quoted and proposed in the open government act. I refer to tab 3.
Second, pass the provisions proposed in the open government act requiring that decision-making under the Access to Information Act be delegated to the ATIP coordinators. Get it off the tables of the senior officials.
You may be interested to know, for example, that in the Privy Council Office the delegation to answer access requests resides at the assistant secretary level or above. The deputy minister and the minister, along with the ATIP coordinator, should by statute be made legally accountable for respecting the act's rights and obligations. Those suggested provisions are also at tab 3.
Third, when transgressions occur, ensure that there is appropriate discipline and that other public officials are made aware of the discipline.
I know there are two theories about discipline in the public service. The most prevalent is to keep it quiet so it's only known to the individual and the manager. We heard some of that in the testimony of Commissioner Zaccardelli earlier this week, but that has no pedagogical effect within the public service.
Fourth, establish a code of professional ethics for access to information and privacy coordinators, an important element of which is the obligation to protect requester identities.
To assist you in your deliberations, at tab 6 I have included an excerpt from the commissioner's annual report of 1997-98, where we have suggested what the elements of a code of ethics for access coordinators should be, including the requirement of a strict duty to keep confidential the identity of access applicants.
Finally, provide a greater measure of independence from institutional pressure for access to information and privacy coordinators in the same manner as crown counsel are given institutional independence from their departmental clients.
Thank you for giving me the opportunity to make these remarks.