Information & Ethics Committee on April 17th, 2008

[The Chair, Liberal, Paul Szabo]

Good afternoon, colleagues. We are here for the 29th meeting of the Standing Committee on Access to Information, Privacy and Ethics.

Today, pursuant to Standing Order 81(4), we are dealing with main estimates 2008-09, vote 45 under Justice, referred to the committee on Thursday, February 28, 2008.

Today we have as our witness from the Office of the Privacy Commissioner of Canada, the Privacy Commissioner of Canada, Ms. Jennifer Stoddart. We welcome you. Today we have two sessions. One deals first with your estimates, and then once we have completed discharging those responsibilities, we want to speak with you more generally about the Privacy Act.

Without further ado, I invite you to introduce your colleagues who accompany you today. I understand you also have an opening statement, so I'd ask you to please begin.

[Jennifer Stoddart, Privacy Commissioner, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chairman. I am certainly very happy to be here and very happy that we have this double session.

I would like to take the opportunity of introducing Assistant Commissioner Elizabeth Denham. This is her first appearance, not only before the committee but on the Hill. We are very pleased that Elizabeth has joined us from the office of the privacy commissioner of Alberta, and she brings a much-needed perspective from the provinces to our functioning.

Also with me is the director general of finance and administration, Mr. Tom Pulcine, whom you have met before.

I have a short opening statement, which I hope will summarize the issues in the document that is set before you and will allow you to approve in principle the credits that go with us.

If I go back now to 2005, where we fixed our mandate of trying to take a more proactive approach to protecting and promoting the privacy rights of Canadians, we have received some increased resources. This has allowed us to reduce our backlog of investigations; reduce turnaround times for privacy impact assessments; be more active in the investigation field; initiate more complaint investigations--most recently, the TJX data breach, the U.S.-based owner of Winners and HomeSense stores; increase the number of audits that we've been able to undertake, and you may have seen the special report to Parliament on the RCMP this winter; and become actively involved in court litigation.

When we received more resources we understood our new vision for the organization, but we underestimated the challenge of implementing it. We now realize that we need to double our efforts to become more efficient in investigating. This is partly due to contextual challenges as well as to our ongoing obligation under both acts to receive and investigate every complaint that comes to us.

Through our work it has become apparent that more targeted and more specialized communications and outreach activities are needed to foster privacy awareness among Canadians.

For example, we've begun the development of a social marketing campaign on children's privacy online. We've embarked on a regional engagement program to better understand the privacy concerns and the awareness levels of citizens across the country.

We recognize the need to address key issues in order to have a real, positive, and measurable impact in niche areas, so we've identified four priority privacy issues on which to focus efforts over the next three years. These are information technology, privacy and national security, identity integrity and protection, and genetic privacy.

These priorities will allow us, we hope, to leverage resources across the organization, to plan concerted and collaborative action with key stakeholders, to build the necessary expertise and capacity, and to adopt a deliberate, multifaceted approach using a number of enforcement tools and research and education efforts to more effectively address these emerging privacy issues.

Finally, the implementation of the Federal Accountability Act last year has resulted in new responsibilities for our office. To handle these responsibilities we've created an office to manage access to information and privacy requests. We are now hiring additional investigators to handle new organizations that are now subject to the Privacy Act, and we are establishing an internal audit program, which is required of all entities.

In recognition of this new vision and our organizational challenges, we have identified five strategic priorities for the new year: continuing to improve service delivery through focus and innovation; strategically advancing global privacy protection for Canadians; supporting Canadians to make informed privacy decisions; building a sustainable organizational capacity; and providing the leadership to advance the four priority privacy issues I've mentioned.

Throughout the next year we will continue the work we began last year in reshaping our organization to make it more modern, responsive, and proactive. As I said, I'm very pleased this year to welcome Elizabeth Denham, who has been our new assistant privacy commissioner since November of last year. As the assistant commissioner with primary responsibility for PIPEDA, Ms. Denham is tasked with raising privacy awareness and ensuring legislative compliance among businesses. She has led the organization's regional engagement efforts, meeting with stakeholders and forging important relationships in the Yukon, in Saskatchewan, and in Nova Scotia in the very short time that she has been in this post.

I'd like to move on now to the theme of building sustainable organizational capacity. We are currently updating our organizational human resources plan, in keeping with our objective of building a sustainable organizational capacity. Our plan has two main components: a staffing strategy that allows us to build our workforce, and a retention strategy to engage, develop and retain our staff.

Our human resource plan is ambitious—as you will note in the graph you've received, we need to substantially grow our organization to adequately address our organizational workload and manage the increase in demand for our services.

Nowhere is the demand for our services greater than in our Investigations Branch. Last year, we reported to this Committee on our efforts to chip away at our backlog of complaints. While the backlog of PIPEDA complaints has been substantially reduced, our backlog of complaints under both the Privacy Act and PIPEDA remains, because we continue to face challenges attracting and retaining investigative personnel. Each year for the past two years, this branch has experienced a 40 per cent turnover in staff.

Along with the staffing and retention strategies I've already mentioned, we are re-engineering our entire business process. Ms. Denham is responsible for this initiative. We are seeing more complaints involving technological and transborder issues. There is an ever-increasing need for cooperation with our provincial and international counterparts. Our goal is to create a branch with the skills, knowledge and processes to respond to these complaints efficiently and well. We anticipate the re-engineering of our processes to be completed in 2009.

Last fall Canada hosted the 29th annual Conference of Data Protection and Privacy Commissioners under the theme of “Terra Incognita”, bringing together over 700 data commissioners and privacy experts from around the world to share ideas and knowledge.

I think you've all received, Mr. Chairman, this résumé of the proceedings. We were honoured by the presence of Speaker Milliken, who opened the conference. Overall the conference was deemed an overwhelming success by delegates, who left Montreal with a renewed sense of common cause and action.

One prevalent theme that emerged from our conference is that citizens around the world are increasingly concerned about when and how their personal information is shared across international boundaries. To address this growing concern, we have made global privacy protection, with a strong dose of Canadian content, one of our five strategic priorities. One country or jurisdiction alone cannot confront the phenomenon of outsourcing and the range of privacy issues that flow from it. At the international level we have started this work to find solutions to the privacy issues implicit in transborder data flows.

In conclusion, Mr. Chairman, the environment in which our office operates continues to evolve, demanding from us that we evolve along with it so that we may fulfill our mandate of protecting and promoting the privacy rights of individuals.

This year promises to be a dynamic one for our organization. From our internal recalibration of our business processes to our new outreach initiatives, the key word for us is change.

While our current resources have allowed us to take on several major initiatives in support of our new vision, there are still gaps we need to fill and challenges we need to address, many of which I mentioned today. In the coming weeks I look forward to engaging you once more to outline how we plan to meet these outstanding challenges.

Our goal is to become a data protection authority that is modern, proactive, efficient, and sufficiently flexible to adapt to the realities around us, so that we may provide Canadians with the necessary assurance that their personal information is being respected and protected here and elsewhere in the world.

I thank you once again for the opportunity to speak to you today, and I would be pleased to answer your questions.

[The Chair, Liberal, Paul Szabo]

Okay. Let's begin now with Mr. Murphy, followed by Madame Lavallée, Mr. Martin, and then Mr. Wallace.

[Shawn Murphy, Liberal, Charlottetown, PE]

Thank you very much, Mr. Chairman.

Thank you, Ms. Stoddart and members of your office, for being here today and for this presentation.

If I study the history of your office, your scope and mandate seems to have been extended or expanded quite a bit with the provisions of the Federal Accountability Act. I don't see any increase in the resources. It did increase substantially in 2004, 2005, and 2006. Do you think with your increased mandate that you have the resources to fulfill the new duties that are being imposed upon your office?

[Jennifer Stoddart]

Thank you.

Mr. Chairman, the credits we will need in order to apply the Federal Accountability Act are calculated automatically by Treasury Board and therefore will be added automatically to the credits we will have in the coming year.

[Shawn Murphy, Liberal, Charlottetown, PE]

Are they reflected in the estimates before Parliament now?

[Jennifer Stoddart]

Can I ask the chief financial officer to respond?

[Tom Pulcine, Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada]

They're not currently reflected.

There are multiple sources of information within our reports on plans and priorities. In one of the financial tables, you'll see the amount related to the Federal Accountability Act. On page 7 of the report on plans and priorities, it's identified under “Implementation of the Federal Accountability Act”, a total of $1.1 million.

[Shawn Murphy, Liberal, Charlottetown, PE]

But would that be above your own estimates?

[Tom Pulcine]

That's right. It's not currently part of the estimates before you today.

[Shawn Murphy, Liberal, Charlottetown, PE]

Is there any reason that wouldn't be reflected in your own estimates? I can't understand it.

[Tom Pulcine]

To have those added to our appropriation, we must present a Treasury Board submission. Before we do that, of course, we would present a business case to the new all-party parliamentary panel to get their blessing, and then we'd bring that to Treasury Board through a Treasury Board submission. It would show up in the supplementary estimates.

[Shawn Murphy, Liberal, Charlottetown, PE]

Ms. Stoddart, you're the accounting officer, I take it. You're designated the accounting officer for the department?

[Jennifer Stoddart]

Yes, I am.

[Shawn Murphy, Liberal, Charlottetown, PE]

And, Mr. Pulcine, you're the chief financial officer?

[Tom Pulcine]

Yes.

[Shawn Murphy, Liberal, Charlottetown, PE]

Going through the whole issue of comptrollership, you report to whom, sir? I'm just trying to follow this.

[Tom Pulcine]

To the Privacy Commissioner.

[Shawn Murphy, Liberal, Charlottetown, PE]

But from a comptrollership point of view, are there any other higher-ups than you to whom you report?

[Tom Pulcine]

I think there's a theoretical, if not a practical, link between me and the Comptroller General.

[Shawn Murphy, Liberal, Charlottetown, PE]

And you're satisfied—

[Tom Pulcine]

Unlike many other government departments and agencies, the Privacy Commissioner, being an officer of Parliament, has a somewhat unique role with Parliament that differs from that of a departmental head.

[Shawn Murphy, Liberal, Charlottetown, PE]

That's what I'm getting at.

As you know—and it's absolutely no reflection on you or Ms. Stoddart—this particular office has had a checkered past vis-à-vis comptrollership.

Are you satisfied, as the chief financial officer, and you, as the accounting officer, that all of those problems are behind us and that everything is being done in accordance with all Treasury Board rules and guidelines?

[Jennifer Stoddart]

Yes, I am—certainly, to the best of my knowledge.

I might add that this particular challenge of being an agent of Parliament while making sure that we conform with all applicable government policies, particularly on financial accounting matters, is a matter of active discussion between Treasury Board and the agents of Parliament. Briefly put, we have agreed that we will follow the standards, by agreeing among ourselves to be audited by a single auditor other than Treasury Board. The auditor will lay its report before Treasury Board. So, in fact, we will keep our nominal autonomy, but will follow the same standards.

[Shawn Murphy, Liberal, Charlottetown, PE]

So is the Auditor General your designated auditor, or do you go outside?

[Jennifer Stoddart]

No, we would go outside to find a third party who would audit...I think all of us are in the discussions.

[Tom Pulcine]

In terms of an internal audit capacity, but in terms of our audited financial statements, it is the Auditor General who does our audits.

[Jennifer Stoddart]

Yes. I was talking about internal audits.

[Shawn Murphy, Liberal, Charlottetown, PE]

One issue that comes up when I review the reports on plans and priorities and the departmental performance reports, which seems to be becoming quite prevalent within departments and agencies, is the whole issue of human resources.

Is your office experiencing the same problem? Do you have a lot of people in acting positions? Do you have high turnover? Do you have difficulty recruiting qualified staff? Do you consider this a major issue?

[Jennifer Stoddart]

Thank you for that question.

In the material we prepared for you, we have given you some tables at tab 5, because this issue has been a concern of the committee in the past.

The quick answer to your question is, yes, we experience all of those problems, but we experience them no more nor less than the rest of the public service. There is huge turnover in personnel, for all kinds of reasons, which are well known. That has singularly hampered our recruiting and our retention efforts.

[Shawn Murphy, Liberal, Charlottetown, PE]

Do you have in place a fairly comprehensive human resources plan to deal with these issues, which seem to be experienced by every department and agency here in Ottawa?

[Jennifer Stoddart]

Yes, we do. I mentioned it; we are reinforcing our retention plan.

For example, we are developing a questionnaire for exit interviews. Because we're in competition with many other agencies and departments in Ottawa, we're trying to make ourselves an employer of choice. We're trying in particular to look at how to attract and keep the bright, highly technological, and skilful younger people whom we need.

[Shawn Murphy, Liberal, Charlottetown, PE]

How many full-time equivalents or FTEs do you have?

[Jennifer Stoddart]

Right now, we have 122.

[Shawn Murphy, Liberal, Charlottetown, PE]

Approximately how many of those would be acting positions and how many would be vacant positions?

[Jennifer Stoddart]

There are very few in acting positions right now. There are two....

Most of those, or 106, are full-time indeterminate positions. There are nine acting, one student, and two part-time positions, and the rest are either loaned out or loaned to us.

[Shawn Murphy, Liberal, Charlottetown, PE]

I have nothing further.

Thank you very much. I appreciate it.

[The Chair, Liberal, Paul Szabo]

Madame Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you very much.

I would like to begin by welcoming you to our Committee. We have met with you several times before, and it's always a pleasure to see you again.

In the conclusion of your presentation, you say:

This next year promises to be a dynamic one for our organization. From our internal recalibration of our business processes to our new outreach initiatives [...]

I would like you to explain what you mean by “recalibration of our business processes”. I am also wondering what is meant by “new outreach initiatives”. Although I am quite well educated, I do not understand the meaning of the expression used in French.

You go on to say that the key word for you is change, but I don't know what kind of change you're referring to.

[Jennifer Stoddart]

As regards a number of our business processes, there remain some significant challenges: rethinking our way of carrying out investigations, making more room for mediation and trying to accelerate our processes. And, I would like to highlight that point in relation to the investigations we are currently carrying out. At the present time, we are focussing more and more on the information provided to complainants initially, so that they have the tools they need to resolve their issues. And that clearly relates to investigations, which are a central aspect of our activity.

I mentioned that we have been conducting more investigations that we ourselves initiate. That is an important tool. When you have reasonable grounds to believe that there are problems, you need to be proactive and find out for yourself. In our increasingly technological world, ordinary citizens, and even people in our own offices, may not be aware of existing problems, because they occur in a virtual world. Investigations in the virtual world are therefore one of the important areas where we must get involved. Here are some examples.

We carry out joint audits—for example, with the Auditor General—and we work with the provinces who are interested in cooperating with us.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You say that you want to review the way you conduct investigations, and you mentioned that you would come back to this a little later. However, I would like you to explain how the process works now, and how you would like it to work.

[Jennifer Stoddart]

In order to be fair, the way we currently do investigations is such that we work on the basis of the order in which we receive complaints—one after the other. At least, that is the way it was previously. We have changed our way of doing things. Increasingly, we want to make an intensive effort right from the start, not only to keep citizens and organizations informed, so that they can correct the problems themselves, but also to triage complaints strategically, so as to focus on those that have a significant systemic, social or institutional impact.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Without giving me a real-life example, could you nonetheless give me a more concrete example, so that I can understand what you mean by the term “triage”? How does triage work?

[Jennifer Stoddart]

We are currently developing a triage factor analysis grid. For example, we're interested in finding out whether a specific problem is raised often by the same individual. Some people are almost like subscribers. Under one of our acts, it is difficult for us to close a complaint file or refuse to deal with complaints made by those who contact us regularly. I think that, for the public, there is a need to put an end to…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

So, if I understand you correctly, the rule that 20 per cent of the people generate 80 per cent of the work seems to apply to you as well.

[Jennifer Stoddart]

Yes, exactly. You put your finger on it.

A citizen or a group can raise an issue which has repercussions, either all across the public service, or in the private sector. It may change the institution's practices as a whole or create a precedent, for example.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

That may be confidential information, but can you just illustrate your point with an example?

[Jennifer Stoddart]

Our lawyers recently argued a case in front of the Supreme Court of Canada. It's a case that we are investing a great deal of time and energy in, because it is very important for all Canadians. The question is whether or not we have investigative powers in relation to documents covered by solicitor-client privilege.

Because it wasn't explained exactly in those terms in PIPEDA, there is a debate as to whether or not we can see those documents. The idea is not to use them as evidence, but simply to determine whether client-solicitor privilege applies. This is a very important matter in all the investigations we carry out under that legislation. We have said that when an organization refuses to cooperate with us for the purposes of an investigation, that we need to go further with this, because it will clearly affect everyone that we investigate.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

If I understood you correctly, you said that, previously, you would carry out your investigations based on the chronological order in which you received the complaints.

[Jennifer Stoddart]

Essentially, yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Now you would like to triage the complaints you receive from regular users. I understood you to say that some people make complaints that you deem to be less important, even though you do not consider them to be frivolous, and you are currently developing an analysis grid to determine which ones are important and which ones are less important.

Did I get that right?

[Jennifer Stoddart]

Yes, and we want that to apply not only to individuals, but to institutions—for example, federal government departments. We would like to prepare a more detailed picture of the complaints that we receive in the course of a year. That requires a kind of computer sophistication that we don't have for the time being, but it is part of the retooling.

In a case where, year after year, we receive dozens of complaints from various sources dealing with the same subject, where the problem has been corrected but comes back subsequently, we need to determine whether, ideally, we should continue to process these complaints or simply carry out our own investigation and table a special report with Parliament, given that the legislation is not being complied with.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

A little earlier, you in fact referred to investigations that you would initiate. Have you initiated any such investigations over the last year?

[Jennifer Stoddart]

Yes, I mentioned the case involving TJX, which is an extensive investigation, and the one involving SWIFT, which is global in nature.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

How many such initiatives have you taken?

[Jennifer Stoddart]

Since 2005, we have initiated about 15 investigations.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

How many complaints do you receive yearly?

[Jennifer Stoddart]

At the present time, about 1,500 investigations are ongoing. Last year, we received 752 complaints under the Privacy Act and 289 complaints under PIPEDA.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Martin, please.

[Pat Martin, NDP, Winnipeg Centre, MB]

That was going to be my first question for Madam Stoddart.

Welcome, and thank you for being here.

I am interested to hear that. I thought it would be the reverse--that you would have a higher volume under PIPEDA and the private sector than you would in the public sector. Do you think that's going to change as people's awareness and knowledge of their privacy rights in the private sector grows, that under PIPEDA the volume might overtake the public sector complaints?

[Jennifer Stoddart]

Anything is possible, but the trend seems to be maintaining itself. There are fewer complaints under PIPEDA than under the Privacy Act. I think you have to look at who complains under the Privacy Act and why. Remember that a lot of our complaints under the Privacy Act are against Correctional Services Canada, the Solicitor General, the RCMP, Employment and Immigration, HRDC, and so on. That's one kind of discrete population.

[Pat Martin, NDP, Winnipeg Centre, MB]

You talk about being able to triage cases, and I suppose it would help you in your volume of casework. But we heard from the Information Commissioner that there's only so far he can go in triaging casework. If the obligation in the act is that the commissioner shall investigate, is that problematic to you? Will you make a recommendation to us to have the language more amenable to what you need to do?

[Jennifer Stoddart]

Exactly, Mr. Chairman. In the second hour of our meeting today, that's one of the recommendations I'll be suggesting to you could be rather easily changed in the Privacy Act, and I've already suggested in PIPEDA, in the letter sent to the Minister of Industry in January of this year, that having more discretion--and commissioners around the world are asking for more discretion--would make us more effective in rendering services to a greater number of citizens.

[Pat Martin, NDP, Winnipeg Centre, MB]

What types of complaints from the Correctional Service of Canada...? Are prisoners filing complaints?

[Jennifer Stoddart]

Yes, people who are incarcerated, and there's also a large number from those who work in the Correctional Services institution. We reported on this at great length in one of our last annual reports. There are serious discussions, and personal information is a part of that, in the correctional world, but it's mostly from the people who are incarcerated.

[Pat Martin, NDP, Winnipeg Centre, MB]

I guess one of the problems you've flagged front and centre, which is self-evident in your reports, has been a 40% turnover in staff. That's a problem in any agency or institution. Is hiring in the public sector part of the problem in filling these jobs, the process of hiring, or is it just a paucity of applicants with the right skill sets?

[Jennifer Stoddart]

I think it's a generalized problem. In fact, I just came from a presentation, if I may quote her, by the President of the Public Service Commission, Madam Barrados, who also reports to Parliament, and across the public service there's a 40% turnover rate.

[Pat Martin, NDP, Winnipeg Centre, MB]

Forty percent?

[Jennifer Stoddart]

Yes. So we're trying to become more refined on how we search for candidates and go to pre-screening, to cross-Canada competitions. We're running one now for a very important job to look at interchanges with other privacy commissioners. It's just a challenge because there are so many other agencies and departments in competition with us for the same pool that we can't hire fast enough, and civil servants are retiring, and so on.

[Pat Martin, NDP, Winnipeg Centre, MB]

Temporary foreign workers, eh, Mike?

Temporary foreign workers, that's the answer.

[Jennifer Stoddart]

We've had some of those too. We've had people from other data protection agencies come and do a kind of stage or a practicum, but they're not a long-term solution.

[Pat Martin, NDP, Winnipeg Centre, MB]

No, of course not.

Thank you.

[The Chair, Liberal, Paul Szabo]

Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chair.

Some of my questions have been answered, in a sense, and I appreciate Mr. Murphy's interjection earlier.

I'll share some of my time with Mr. Van Kesteren, so when I have one minute left, let me know.

I understand, and I had this discussion with the Information Commissioner two days ago, you're working on a plan that would give you more people, more bodies. Is that an accurate statement, based on the FAA? But you're not allowed to reflect it in your future numbers here because it hasn't been approved yet. Is that correct?

[Jennifer Stoddart]

Yes. That's for the parliamentary panel to consider in the coming weeks.

[Mike Wallace, Conservative, Burlington, ON]

I don't really like the system around here, the way we do things. For me, when you look at these numbers for 2008, 2009, and 2010, it's flat at 150 people, which does not reflect what you really need based on the workload you're expecting. Is that correct?

[Jennifer Stoddart]

Yes.

[Mike Wallace, Conservative, Burlington, ON]

Through the estimates process, would it be helpful for you--I know it would be helpful for me--to be able to tell us about the plan, even if it's not approved yet? When I come back, and I keep these books, so let's assume I'm here three and four years from now--it's up to the voters--and I say you told us in 2008 it's going to be 150 people, but there's no future.... When will I see...? Will the first time I'll ever see this, as a member of this committee, be if you get approval and you ask for it in supplementaries?

[Jennifer Stoddart]

Yes, unless, Mr. Chairman, you are also a member, as I understand, of the parliamentary panel, which is composed of many of the members of this committee. I don't think its composition is fixed. There are some members of this committee, I know, who've been on the panel. We go before that panel once we've agreed with Treasury Board on the presentation.

[Mike Wallace, Conservative, Burlington, ON]

From a general point of view, I don't think you had supplementaries last year. I couldn't find anything. You didn't ask for any supplementary money, A or B, right?

[Jennifer Stoddart]

No.

[Mike Wallace, Conservative, Burlington, ON]

But this year, if the plan is approved, there will be supplementaries from you. Is that correct? Do you have an idea of what kind of money that would be? How big of an increase is that if your plan gets approved?

[Jennifer Stoddart]

If the plan gets approved, I think we're looking at something like around 30 FTEs and around $5 million.

[Mike Wallace, Conservative, Burlington, ON]

So it's a significant change.

[Jennifer Stoddart]

Yes. It's under discussion with Treasury Board.

[Mike Wallace, Conservative, Burlington, ON]

When I look in this book and it says 154, that's your approved complement, is that correct? But you're only actually at 122. Is that accurate? So how much did lapse in this year?

[Jennifer Stoddart]

My recollection is that none lapsed, because of course we have to look at all the ways to compensate for this terrible problem of not being able to hire personnel. So we contracted out to professional and special services a lot of the--

[Mike Wallace, Conservative, Burlington, ON]

So the money that would have been spent on staffing was used to pay contractors to do the work that needed to be done. Is that correct?

[Jennifer Stoddart]

That's right, and then we have a carryover almost to the limit, I think, that we're legally allowed.

[Tom Pulcine]

That would constitute or relate back to your lapse. All government departments and agencies are allowed to carry forward 5% from one year to the next year.

[Mike Wallace, Conservative, Burlington, ON]

It's 5.3%. Even for my MOB it's 5.6%.

[Tom Pulcine]

That's right.

[Mike Wallace, Conservative, Burlington, ON]

I don't know if you knew that, Tom, but now you know.

[Tom Pulcine]

Some people refer to that as a lapse from one year, when actually it becomes automatically a carry forward to the next year.

[Mike Wallace, Conservative, Burlington, ON]

And that carry forward, does that go on your base?

[Tom Pulcine]

No, it's identified as temporary resources, per se.

[Mike Wallace, Conservative, Burlington, ON]

You can eat it up the next year, but it doesn't become part of the base from here on in.

[Tom Pulcine]

It doesn't, no.

[Mike Wallace, Conservative, Burlington, ON]

When I look at the organization chart from last year to this year, it's a bit different. There hasn't really been any change; it's just the way you presented it that's changed. Is that an accurate statement?

Last year you had the Privacy Commissioner and two assistant commissioners. This year you have the two assistant commissioners actually laid out in the chart--who they are.

So when I see public education and communications, which I circled last year, that's a director position of communications now. Is that correct?

[Jennifer Stoddart]

Yes.

[Mike Wallace, Conservative, Burlington, ON]

In your reorganization that I'm seeing here, it's just a presentation issue. You haven't done your reorganization yet, compared to what....

[Jennifer Stoddart]

No, I think we're just giving more detail.

[Mike Wallace, Conservative, Burlington, ON]

Okay. I just wanted to make sure I understood that.

You're asking for, let's say, a one-quarter increase in what you're actually using. When would you expect to have that in place? What's the timeframe on getting approval for your plan, assuming you get it or not? If you're having a hard time hiring people now, how are you going to hire another 30%?

[Jennifer Stoddart]

It's a long and slow process. I understand we have a tentative appearance before the parliamentary panel on May 7--not confirmed--and then processes are a couple of months, I suppose.

[Tom Pulcine]

We're tentatively scheduled in early May to appear before the parliamentary panel on funding for offices of Parliament. If that takes place, then a Treasury Board submission would be prepared and submitted to the Treasury Board, which may get approval two or three weeks later. Then it would show up in the supplementaries that would be presented to you, probably in October, November, whenever the supplementaries would be presented.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chair.

Thanks for coming.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Twice now we've heard this, and I was going to ask the Information Commissioner the same question, but I'm going to ask you the question. In relation to your clog-up by the Correctional Service, is this a problem we should know about? Is it abuse of the Office of the Privacy Commissioner? Are we just seeing some time wasted? Is there something we need to know as parliamentarians so that we can do something about this?

[Jennifer Stoddart]

I'm suggesting that the time of the Office of the Privacy Commissioner could be better spent. You could suggest bringing reform to the Privacy Act and also to PIPEDA. We don't even have the possibility of declaring complaints frivolous and vexatious and made in bad faith, as we do under PIPEDA. Even that is not that useful.

We need to pick and choose. I think for some complaints we have to be able to say to citizens, “Okay, this is all the information. This has been decided time and again. Here you are.” Then we can concentrate on something that is going to impact thousands of Canadians.

So yes, I don't think our time is well spent having to investigate every single complaint. And then someone can make a complaint once the organization has not replied within the 30-day time limit. Some populations do that more than others. I don't think it's useful to the concept of privacy rights in Canada.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Is it part of your recommendation?

[Jennifer Stoddart]

It is, Mr. Chairman, yes.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

So it's spelled out well enough that we can....

[Jennifer Stoddart]

Yes, it's one of the recommendations.

[The Chair, Liberal, Paul Szabo]

If I may, I'd like to follow up on the contracting of staff. This has been a serious problem brought up by the Auditor General for years. It's so prevalent throughout the public service it isn't funny. I'm just wondering if Ms. Barrados has some concerns to express to other departments, agencies, commissioners, and so on.

Your numbers show that obviously it's more expensive. But the reason it's been so prevalent is that you can get somebody in and on the ground and behind a desk a lot more quickly by contracting out than by waiting for the full cycle of a hiring process. I just don't know what your views are. I want to know whether you really think this is a problem.

[Jennifer Stoddart]

I think it's a huge problem. I know that Ms. Barrados, just coming from a presentation she gave, thinks it's a problem for all of us, because when you wait to hire people full time, you may wait a very long time.

We have a very specialized employee we've been waiting for. It's been six months since we made an offer of employment. Now, this is a particular question for us. It's a security clearance. You understand that a lot of our work needs security clearances, and after six months the person doesn't have a security clearance. That's apart from the time it took to go through the hiring process.

So we look at our mandate, what we have to do, and the services we're supposed to render, and we try to get them done. We're all concerned. But we're all competing with each other and making offers and kind of poaching each other's employees. It's a very difficult world. I could hire that person to whom we've made an offer after that person has passed the security clearance, and with two weeks' notice—this is how the rules work—the person can be off to another department. It may take me eight months to hire someone, but the person can leave in two weeks. It's not something I individually can change. So since I have the money, how do I get the work done according to the rules?

[The Chair, Liberal, Paul Szabo]

We could talk a lot about this. I think you're now aware that the committee is concerned about this. We need to know about a game plan for getting out of this trap, because it's something we have to have a plan to do within a certain period of time. I don't know all the implications. But I hope we're going to be able to come up with a strategy to deal with this so that when you come here and talk about backlogs, we understand why the backlogs are there from the standpoint of the inadequacy of the act as opposed to HR shortcomings.

We'll go to Mr. Dhaliwal.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you, Mr. Chair.

Madam Privacy Commissioner and associates, welcome to the committee again.

I'm having concerns about building sustainable organizational capacity. The way I see it, you are facing the same dilemma as any private business or private consulting company, and they are feeling the same way you're feeling about hiring employees and keeping them. When I look at your situation, it's even more complicated because you need people who go through a security clearance.

When I look at the next ten to fifteen years, the net labour growth in Canada is going to come from immigration, and when I look at the last two years, the number of permanent immigrants into this country has gone down by 36,000 people.

[David Tilson, Dufferin--Caledon, CPC]

That's why we thank you for supporting our immigration policy.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Mr. Tilson, I'm not going to....

How do you see it, because building a sustainable organization capacity is a good vision? Every outfit should have that, and you're facing the challenges. When I look at your budget, you're going down in your budget from last year. Is this true?

[Jennifer Stoddart]

Yes, we're going slightly down, by about $500,000.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

If you have to keep those talented people working for you, I'm not sure how you can sustain them if you do not have a proper plan in place or proper benefits. So how would you be able to manage with the lower numbers with the high demand of those employees?

[Jennifer Stoddart]

Well, there are two things. I did mention that we do have human resources plans in place to increase hiring and to look at the issue of retention. How, within the same rules that apply to everybody, can we make sure people want to stay with us longer or more consistently rather than accepting job offers, as a way, within this context that everybody is faced with, of trying to basically swim against the tide? So we are looking at that.

You mentioned several things. Yes, our budget did decrease slightly, but as we mentioned previously here, we are going to ask for some more resources in order to bring it back up and to deal with new issues, like the federal accountability bill.

From year to year, though, if you look, we have steadily increased the number of permanent, full-time indeterminate positions. It kind of goes like this: people go in, people go out. There's what's called churning, which is very difficult for an organization, but we're working the base up, and I think too we're starting to attract a group of very interesting young employees.

One of the honourable members, Mr. Chairman, made a reference to our past. I think probably in the past that was a deterrent to people wondering what they would get into if they came and worked there. I think we've put that in the past. We have some fascinating issues for people to work on, and I think we're starting to attract more and more talented people. So I'm quite optimistic that we can inch our way up in terms of employees.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

I totally understand that you need talented employees working for you. It's the same dilemma I'm facing in my business, even though I don't go there. But I don't know how you can keep them with the same number of resources, with all those costs that are going up. How can you keep those employees working there when you're facing competition in the private sector?

You have to have a certain plan in place. Can you tell me what are those...? You have to attract those talented employees. How would you attract them to your organization, to work for you and not for another organization?

[Jennifer Stoddart]

Well, one of the elements we're looking at is the type of working conditions people in our organization can benefit from. For example, we're fairly flexible about things like working hours, and we're looking at something many employees are interested in: the work-life balance. So, for example, we're organizing sessions where employees can basically look after their physical condition, sponsored by the office, all within Treasury Board guidelines.

Another example is giving them more direct responsibility, because we're a small organization. I know one talented employee left us and came back, having worked for a large organization. This employee said, “Well, if I go to a large organization, I don't have the direct impact that I can have in working in a small organization like ours”. So those are some of the qualities we can enhance to try to attract and keep talented people.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Tilson, please.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Thank you, Mr. Chair.

Thank you for your presentations, particularly the written presentations.

You can see this business of staffing is bothering us, and I'm no exception. I look at the chart, particularly the chart under tab 5, page 3, which shows there are almost as many people leaving as coming. I gather this is explained a little bit on page 5, where it shows 35%.

Are those contract people? Who are those people?

[Jennifer Stoddart]

Yes, those are term employees.

[David Tilson, Conservative, Dufferin—Caledon, ON]

I understand that. So do those people come back? I guess I'm trying to figure out how you operate. Do you hire people under contract, and when their term expires they're gone forever, or do you hire them again under another contract?

[Jennifer Stoddart]

It can be a mixture, Mr. Chair. Occasionally they can be hired back, but best policy says one is not supposed to keep hiring employees under contracts that keep repeating themselves.

[David Tilson, Conservative, Dufferin—Caledon, ON]

I understand that, and I guess--

[Jennifer Stoddart]

But I can't say that it doesn't ever happen, for the reason that we have a talented.... For example, one of the situations that we often meet now is that our own employees retire, but they're interested in working for us part-time. They have all the skills. They know the files. They have the security clearances. I don't think it's unique to the Office of the Privacy Commissioner.

I've never seen a particular study of it, but some of those, for example, on very specialized files, can be useful and may have--

[David Tilson, Conservative, Dufferin—Caledon, ON]

Yes. I guess I just look at efficiency. I understand your problems of security, and I don't even know what that entails--probably a lot.

But you look at efficiency and the starting of files, and then they leave. It's like in any other office. You start on something.... You don't have to tell me about it. There has to be a lot of inefficiency with this system when the largest portion of people who leave appear to be--I'm probably reading it wrong--people on contract. I don't know what they do, but if they're doing research, if they're doing mediation, if they're doing legal work, technically, they could leave in the middle of a file.

[Jennifer Stoddart]

Usually on a contract they stay to the end of the contract. It's the permanent employees who, inversely, Mr. Chair, can leave with two weeks' notice, as I've said.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Yes, well, you obviously have a problem.

[Jennifer Stoddart]

I do.

[David Tilson, Conservative, Dufferin—Caledon, ON]

You do education, you do research, you do mediation, you do legal work, you go to the Federal Court. Is that basically it?

[Jennifer Stoddart]

We do an increasing number of communications, public education--

[David Tilson, Conservative, Dufferin—Caledon, ON]

I assumed that included education, yes.

[Jennifer Stoddart]

--and outreach, where....

[David Tilson, Conservative, Dufferin—Caledon, ON]

Getting into the complaints, is most of the work mediation and conciliation?

[Jennifer Stoddart]

And investigation of complaints.

[David Tilson, Conservative, Dufferin—Caledon, ON]

And investigation. Do you contract that out, or do your permanent staff handle that?

[Jennifer Stoddart]

No, we do have some employees who work on contract. They're usually former investigators--in fact, all are.

[David Tilson, Conservative, Dufferin—Caledon, ON]

What did you spend on mediation and conciliation this past year as opposed to the year before?

[Jennifer Stoddart]

It's somewhere in the $3 million....

[David Tilson, Conservative, Dufferin—Caledon, ON]

And I assume that would include contract workers. Is it possible to lump it in as to which...? I'm trying to determine what you do. Is that possible?

[Jennifer Stoddart]

It is, but we have a plethora of figures here--

[David Tilson, Conservative, Dufferin—Caledon, ON]

I find you can solve the impossible, Madam.

[Jennifer Stoddart]

Not always immediately, though.

Mr. Chair, this year we plan to spend roughly $3.5 million on investigations and inquiries. Last year's figure was probably a bit more because some of our resources sunsetted, and that's why we're going back for supplementaries before the parliamentary committee. I don't have them right here to refer to exactly, but it will be in our forthcoming--

[David Tilson, Conservative, Dufferin—Caledon, ON]

If you average them out, is it about the same?

[Jennifer Stoddart]

Yes, within half a million it's the same up until now.

[David Tilson, Conservative, Dufferin—Caledon, ON]

This is my last question. Presumably you have some in-house counsel, some outsourcing, and some legal services somewhere in your paperwork. You have three sources, do you?

[Jennifer Stoddart]

For legal services, we hire our own counsel. We're not linked to Justice, as other agencies are. We have our own. Currently we have nine lawyers. Exceptionally, we contract outside counsel.

[David Tilson, Conservative, Dufferin—Caledon, ON]

How much do the inside and outside counsel cost this year compared to last year?

[Jennifer Stoddart]

It seems it's about $300,000 for outside counsel, Mr. Chairman.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Would that be for this past year versus the year before?

[Jennifer Stoddart]

That is the projection for this year, but my chief financial officer tells me it's been very consistent year to year.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Thank you.

[The Chair, Liberal, Paul Szabo]

Thank you, Mr. Tilson.

Before we go on, I'm looking at the pie chart of departures by reason. The total for 2007-08 is 51 persons, only five of whom left due to retirement. That doesn't square, I guess, with the impression I got that throughout the public service we're looking at a 25% to 40% retirement rate because of baby boomers and stuff like that.

Fifty-one people represents an enormous percentage of your human resources complement, and I would think any organization couldn't possibly be productive and functional to the levels that should be expected. This looks like an issue that we would like to spend a little more time on. We can study other departments, but I have a feeling maybe we should look at our own backyard first. I do know that we have similar issues in the access area as well.

We know about the human resources, but now let's look at the other side, the productivity of the Privacy Commission. How do you define backlog?

[Jennifer Stoddart]

Backlog is currently defined as unassigned cases.

[The Chair, Liberal, Paul Szabo]

And that is because you don't have the people to give them to?

[Jennifer Stoddart]

That's right.

[The Chair, Liberal, Paul Szabo]

So if everybody were busy and you had a normal complement and there was nothing in the hopper, then you would say you have no backlog?

[Jennifer Stoddart]

Yes, and in fact many investigators have far too many cases to be very efficient with them, but we assign them, because then possibly they can contact the person and try to help them over the phone and so on.

[The Chair, Liberal, Paul Szabo]

Is there another way to define backlog that might be a little more appropriate or telling about how well we're serving the purpose for which the commission exists?

For instance, you say if they're not in the hopper and they haven't been assigned, and there are also a bunch of people who have too many files, things are not getting done. Obviously the throughput or the disposition of files is not coming out, and the backlog that is being represented really isn't a true backlog.

How bad is it?

[Jennifer Stoddart]

There are many ways to define this.

In terms of complaints that are unassigned, under the Privacy Act there are 368 now, and under PIPEDA there are 49. As you suggested, Mr. Chairman, there are many ways--and I think some of you are accountants, so you know--that we can divide the definitions of our complaint process. We juggle with those and attempt to see how we can do our job most efficiently with existing resources and within the requirements of the act, given that we cannot, as I've explained, under either act quickly say, “We're not going to deal with that”.

[The Chair, Liberal, Paul Szabo]

Do you have service standards?

[Jennifer Stoddart]

Yes, we do.

[The Chair, Liberal, Paul Szabo]

How are we doing with our service standards?

[Jennifer Stoddart]

We are not doing as well as we might hope. Under the Privacy Act, there are different kinds of service standards. In general, treatment times should be 10 months. We are now at 14.4 months for a Privacy Act complaint. Under PIPEDA, the law says we are supposed to investigate complaints within a year. My latest information says we're taking an average of 16.5 months.

[The Chair, Liberal, Paul Szabo]

I think everybody understands where we are. We all need to think a little more, and I believe we're going to look for an opportunity. I'm sure the committee will want to look for an opportunity. This is not just you, not just the Privacy Commissioner. I understand that. There is a cultural issue here. We're part of it, and we want to work together. I hope we will be able to play a role in having a plan on the table, a viable plan with realistic service-level targets and achievement standards.

People should be rewarded for meeting those targets. And when we have other circumstances, we can make changes. However, we can deal with that. We're not going to resolve it right now. But I think it's helpful to understand, both operationally and from the estimates perspective.

Are there any final burning questions?

[Mike Wallace, Conservative, Burlington, ON]

I have a comment on the estimates. I appreciate your coming today. Since some of my colleagues on the other side aren't that excited about estimates, I think it was important that we highlighted some of the problems you've indicated.

My issue with estimates was highlighted again today. What's not approved yet doesn't show up. The plan is not accounted for, and they have a three-year plan. I don't know how to make the change, but we should be having organizations or departments let us know their plans. This way we could have a proper discussion about it. At the end of the day, somebody else is going to decide, not this committee. It's going to come back as a supplementary (A) or a supplementary (B). It's going to be a fait accompli.

If I gave this to my neighbour, it would look like they have 150 people for the next three years and they're not raising it. From a layman's point of view, their increase doesn't even cover the cost of an inflationary-rate increase in salary.

I think it's important for us to be doing these estimates pieces. I'm glad we've done them. I think it's highlighted a number of issues, and I appreciate the indulgence that my colleagues from the other side have given me to get some of these issues on the table.

Thank you.

[The Chair, Liberal, Paul Szabo]

We're not going to suspend or anything. We're just going to carry on, but now let's put a little focus on the other aspect that we wanted to discuss with you and your people.

[Jennifer Stoddart]

Could we have a change of guard, Mr. Chair?

[The Chair, Liberal, Paul Szabo]

We can. Why don't you do that.

We're now moving toward a dialogue with the commissioner with regard to the Privacy Act itself. The committee has had some discussions about making some good use of our time, but because the House doesn't sit for three months, it really is not our first choice to start something, leave it alone, and come back three months later. It's just not a very productive approach.

We thought what we would do, as you know, is look at an assessment of the current Privacy Act and make some informed decisions as to where we might be able to do some work--within the time available until the summer break--to make some recommendations.

I understand that in that context you have some further opening statements on that. Why don't you introduce your colleagues who are with you and commence with your statement, and then we'll see where we go from there.

[Jennifer Stoddart]

I could go right to the suggestions, Mr. Chair, if that would be more useful.

[The Chair, Liberal, Paul Szabo]

Yes, go ahead.

[Jennifer Stoddart]

I think you know both of the persons accompanying me. Assistant Commissioner Raymond D'Aoust is the commissioner responsible for the Privacy Act. He is the expert on the application of the Privacy Act.

Our general counsel, Maître Patricia Kosseim, you've met before.

Mr. Chair, we have sent quite a bit of material to the committee. You had previously received the study we did on reforming the Privacy Act. We did an addendum of April 2008 and in that made some further observations and suggestions. Maybe I could just suggest, then, in the opening statement, that you turn to immediate changes. It's on page 5, or thereabouts.

[Raymond D'Aoust, Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada]

It's page 2.

[Jennifer Stoddart]

Sorry, it's page 2 in your version, yes. So you have received an addendum through the committee.

[A voice]

That's page 2, immediate changes?

[Jennifer Stoddart]

Yes. They're also at the end of the addendum.

We are trying there, in response to this committee's concerns, to single out some changes to the Privacy Act that we think would more reasonably be possible to adopt with less complex considerations, shall we say. They're also ones that seem to us to be the most important. They are a combination of the most important and the most simple, or the less controversial, in possible debates because, personal information being a constitutional right, there are many debates about the role of government in it, and so on.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Ms. Stoddart, I have a number of documents. I have something called “Reforming the Privacy Act”.

[Jennifer Stoddart]

Yes.

[David Tilson, Conservative, Dufferin—Caledon, ON]

And I have the addendum. Where are you?

[Jennifer Stoddart]

I'm at the addendum, Mr. Chairman, April 2008.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Yes.

[Jennifer Stoddart]

At the very end, “Changes of Immediate Benefit to the Privacy Act.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Thank you, Mr. Chairman.

[The Chair, Liberal, Paul Szabo]

You're going to work with the addendum?

[Jennifer Stoddart]

If that's more convenient to the members.

[The Chair, Liberal, Paul Szabo]

Does everyone have the addendum?

[Jennifer Stoddart]

If we go down that list of the changes...maybe I'll read them out. Number one:

Creating a legislative requirement for government departments to demonstrate the necessity for collecting personal information. This necessity test already exists in Treasury Board policy, as well as in PIPEDA....

It's recognized internationally, for example, in the European Union. The collection must be reasonable, and there must be a demonstrable need for each piece of personal information.

I don't know how you want to proceed, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

Let's get some agreement about how we approach it. This is like a band-aid approach as opposed to discussing how we get that.

We have had a discussion among the committee. I think the discussion I had with you was to identify possible areas, or an area, that we might want to prioritize. There are a number. But we also fully understand that there are overlaps with access and PIPEDA, etc.

As you know, we've also had an interesting dialogue with Heather Black, to help us get a feel for what was happening. It was Heather herself who really brought this suggestion to us. There are a few items here that are quick fixes. They are pretty straightforward and wouldn't require a lot of witnesses or anything like that. They're just the right thing to do. That's where I think you are in your addendum in this area here.

Do you want to make a comment before we do the individual fixes? Can you give an expression to the committee about your view on where we should or could go to be helpful and productive within this relatively short timeframe? What is your assessment? I think you're aware of the question I'm asking. I think the committee may want to engage you on your opinion and recommendation to us.

[Jennifer Stoddart]

Thank you, Mr. Chairman.

Yes, overall as Privacy Commissioner, first of all, I welcome your interest in this topic. The topic is not new, and over a period of many years, beginning five years after this act was passed, there has been a great hesitation for successive governments to make any changes to the Privacy Act, except in consequence of other legislation.

The reform of this act, I think, is extremely important for all the reasons set out in both of the documents, and Ms. Black may have expressed also her concern with the fact that this act now does not meet modern international standards. Even for the government—the government is not subjecting itself to the standards it imposes on Canadian corporations or the rights it gives Canadian consumers in relation to Canadian corporations or the rights it gives to complainants to our office, who do not like the way they've been treated by Canadian commercial organizations, to take their problems further. You can't do that with the government. I think there's a real issue of equity. There's an issue of modernization. There's an issue, in a society that values something as important as this, of making sure the rights are defined in a way that makes them practically applicable today.

There's also the whole issue of the emergence of the information society in a much stronger way than was even foreseen in the early 1980s. You would be interested to know that something like 25 million Canadians are now very active in the virtual world—for example, on Facebook. There are something like 30 hours a week spent by people who are active on sites like Second Life, who live a kind of parallel virtual life.

I'm just using these examples to say how the reality has changed and how the privacy doesn't, and that the issue of personal information and what is being done with it, and so on, is a real daily issue for Canadians, and we don't have a law that's adequate to face that task. My staff and I have tried to come up with these suggestions that I don't think are extremely radical, if you look at the history of suggestions for reform or if you look at more modern legislation.

There are also two more suggestions I'd like to make: one is fairly easy, about a five-year review, and the other deals with the issue of transborder data flow.

[The Chair, Liberal, Paul Szabo]

You said the current act does not meet the evolution of information flow, etc. The question is this. Is the current act reparable, as a starting point, or does it have to be rewritten from scratch?

[Jennifer Stoddart]

In the real world, ideally one could write a whole new information rights law for Canadians, but I think what is more important now is to take the basis of the act. Remember that the act is not alone in assuring Canadians' privacy rights, fortunately. It's also interpreted by our courts. It's subject to the charter itself. Some privacy rights are defined through the application of the Criminal Code, increasingly, and so on. So I think it is in this context eminently fixable, and I have tried to single out the areas where you could suggest a fairly quick change to it—or a fairly simple change. I don't know how quick it would be.

[The Chair, Liberal, Paul Szabo]

I'd like to ask if the members want to jump in on this. Or should we move to the fixes? Do you want to hear the rest of the presentation on the fixes?

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Mr. Chair, we've all had an opportunity to review the documents that have been provided, including the addendum from the Privacy Commissioner. Perhaps the best use of our time would be for us to simply follow the list that's been collected by the clerk and proceed to questions.

[The Chair, Liberal, Paul Szabo]

Okay, that's fair enough.

Next are Mr. Dhaliwal, Madame Lavallée, Mr. Martin, and Mr. Hiebert.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you.

Madam Privacy Commissioner, I have a question for you. You are suggesting we should rewrite the whole act--that is what I'm reading time and time again. You mentioned that we have to overhaul. On the other hand, you're saying there are some immediate benefits or changes we can make.

Can you give us some resources that we have to put in to have the whole act rewritten--and only making those changes you are requesting?

[Jennifer Stoddart]

I'm not sure.... Are you asking me to discuss the merits of both approaches?

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Merits are there. It's not the merits; it's the resources. Do you have a timeframe in mind?

[Jennifer Stoddart]

You're asking how long this would take. That is not a question I can really answer, because it depends on the priority the department or the government of the day puts on it. It involves ideas. It has to go to legislative drafters and through the usual House process.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

When you say “government priority”, has this been looked into in the past few years? Is there any history to it?

[Jennifer Stoddart]

Yes, there is. It was looked into by a parliamentary committee in 1987. Then I believe it was debated in the early nineties as well, and more suggestions for change were made at that time. But they were not taken up by the respective governments, as I understand. There's been no change, so....

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

When they were looked into, were they the same kind of...? Why wouldn't they have made changes? Was there a particular issue? This is not a priority to the government now, and it wasn't one for previous governments, so what is it?

[Jennifer Stoddart]

I don't honestly know. That's not part of the recorded—

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

We're not criticizing one or the other.

When you say we should rewrite, I think we should go further. Do you suggest we go full-blown on this issue, or with the piecemeal deal you are proposing now? Do you have an option?

[Jennifer Stoddart]

I suggest you look seriously at the issues we have suggested. We have also provided the clerk with the names of some witnesses, and it might be interesting for you to hear from them. Then come to a suggestion on what could reasonably and realistically be done in the near future, in terms of changing the most important parts.

[Sukh Dhaliwal, Liberal, Newton—North Delta, BC]

Thank you.

[The Chair, Liberal, Paul Szabo]

Madame Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you, Mr. Chairman.

Your « Addendum » document contains eight suggested changes on pages 9 and 10. If we were to make those eight changes, that would be adequate; you could survive.

[Jennifer Stoddart]

The matter of our survival is more related to the debates held by this Committee in the previous session.

If you could recommend those eight changes, as well as two others that I added…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I was coming to them. When you were speaking earlier, you mentioned two others.

[Jennifer Stoddart]

In my written presentation…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

The five-year review…

[Jennifer Stoddart]

The five-year review, as well as…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

…cross-border information exchange.

[Jennifer Stoddart]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I want to try and circumscribe the list of changes you are requesting. Of course, all of this is hypothetical. If those ten changes were to be made to the current Act, would we be able to handle all the technological changes that have occurred since the Act was passed 25 years ago?

[Jennifer Stoddart]

That may be asking a little too much.

Mr. Chairman, could I ask the Assistant Commissioner, who is very well acquainted with the Act, to answer that question?

[Raymond D'Aoust]

Thank you, Ms. Stoddart.

First of all, the eight changes and our two suggestions would certainly help us optimize our resources and our impact. We would have greater discretion to investigate systemic complaints, as opposed to individual complaints, which have very little societal impact.

Second, we would like the Federal Court have more opportunity to hear our submissions with respect to all the grounds laid out in the Act, and not only denial of access. That is very important, because the cause of action for a private sector complainant can be any of the grounds laid out in the Act, whereas a public sector complainant can only invoke denial of access to personal information.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I would like you to explain what is meant by denial of access to personal information.

[Raymond D'Aoust]

The Act provides that any citizen has a right to request access to information contained in a personal file held by the Canada Border Services Agency, for example. So, under the Act, there is a guaranteed right of access. For example, if you believe you have been injured in that regard, you can seek recourse from the Federal Court.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I understand.

[Raymond D'Aoust]

We believe these changes would mean that the public sector legislation would provide for the same level of protection as what exists in the private sector. That is a very strong argument in their favour. Essentially, why should our rights, in terms of the relationship between citizens and government, be any less protected than they are for consumers dealing with merchants?

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

In terms of cross-border information exchange, what exactly are you recommending?

[Raymond D'Aoust]

If you don't mind, I would like to tell you about the work carried out by the Treasury Board in that regard. It has established guidelines on information sharing in the context of agreements federal government departments have signed with public partners.

We would like there to be an in-depth review of this whole area. Let me give you an example. We are in the process of doing an audit, and the information-sharing agreements run in the hundreds in one department in particular. We have not yet completed that study. So, I would like to keep the identity of the department confidential.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

There are hundreds of agreements—for example, with the United States.

[Raymond D'Aoust]

Yes, or with other levels of government, private partners, and so on. We are wondering who is in charge and who has an oversight role in terms of all these information-sharing agreements. This is not a new issue. I just want to point out that in 1987, a standing committee looked at this. It devoted an entire chapter to transborder or trans-organization data flows. There was an awareness of the issue in 1987. The committee suggested a number of amendments to the Act at the time, but they were never implemented.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Are you recommending that there be a single, standard agreement?

[Raymond D'Aoust]

Yes, I think so. We need a framework for managing these agreements. At the present time, the Act is silent on this.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Yes, totally silent.

[Raymond D'Aoust]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You say that you would like there to be a single agreement. What would be in that agreement? How would information be exchanged?

[Raymond D'Aoust]

For example, there need to be very specific standards with respect to information security, as well as restrictions on secondary uses of that information—in other words, so that it cannot be put together with information from other data banks for verification purposes. They have to be very clear parameters with respect to the use of Canadians' personal information.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you.

Mr. Chairman, do I have any time left?

[The Chair, Liberal, Paul Szabo]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You were not given an opportunity earlier to present each of the changes you are suggesting, but I am interested in hearing your explanation. In the time remaining, I would like you to explain the first change. If I have any time left after that, we can move on to the second change.

[Jennifer Stoddart]

I already presented it.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You talked about demonstrating the need to collect personal information.

[Jennifer Stoddart]

The Assistant Commissioner has just been talking about the principle that underlies the second change we are requesting. That is, the ability to take one's case to the Federal Court on any ground, and not only because you have been refused access to your file. In addition, we are proposing to entrench in the legislation the obligation—which already exists under Treasury Board Guidelines—to carry out privacy impact assessments prior to implementing new programs and policies. This is nothing new. It is simply a matter of enshrining it into law. The fourth change is not new either. The current Act does not give us the mandate to get involved in public education.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You mean training.

[Jennifer Stoddart]

Yes, exactly. We do a little of it.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

If you don't mind, I would like to backtrack for a minute. I want to be sure I understand the third change that is being suggested. It's very nicely written, but it is not particularly clear. You talk about carrying out privacy impact assessments. However, I don't understand what that means.

[Raymond D'Aoust]

Let me explain, Ms. Lavallée. In 2002, the Canadian government, through the Treasury Board, introduced a policy on privacy impact assessments. In English, it is called

privacy impact assessment.

All deputy heads…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

An assessment of privacy impacts.

[Raymond D'Aoust]

Yes, exactly.

We conducted an in-depth audit of the way that policy is being applied, and realized, first of all, that it is very uneven. Second, impact assessments are often conducted after a program has been introduced, which gives us very little opportunity to manage the risks. Third, we believe that entrenching that obligation in the Act would make for a more effective and efficient policy.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Martin is next, and then Mr. Hiebert.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you.

I think you've given us a realistic and achievable road map. It's very helpful, because what we have been wrestling with as a committee is whether we have the time and the resources to do a comprehensive review of the entire act.

Given other interests--reviewing the Access to Information Act and other things--I doubt we could do a thorough job in the time we might have left in this minority Parliament even. I think these eight points, and number 9 and number 10, as you've recommended, are an excellent starting point.

I'm wrestling with the larger issue that maybe personal privacy is a luxury we just cannot afford. It's an expectation that's obsolete in today's....

I'm not trying to be controversial here, but even in your first recommendation, you remind us that in some jurisdictions, governments shouldn't be collecting information unless there's a demonstrable need for each piece of personal information. Under our national security act, doesn't that mean everything? When I see national security butting up against the right to privacy, it really worries me that privacy is going to lose every time, at least in the current environment. I'm really concerned on the larger scale that personal privacy might be roadkill on the road to the new national security environment.

Having said that, I was flipping through the “Terra Incognita” document, which was interesting, and I came across a chapter on privacy seals. It talks about trust marks in commercial operations and, if you want to deal with these commercial companies, what Good Housekeeping seal of guarantee of privacy they may be offering.

What do you think the Government of Canada's privacy seal should be? What level of privacy can we reasonably guarantee to Canadians, and how would that compare?

[Jennifer Stoddart]

Privacy seals are used in the United States and throughout the Asian world right now, so I've never quite asked myself.... They are usually self-administered. It's like a chamber of commerce--

[Pat Martin, NDP, Winnipeg Centre, MB]

It's like ISO 9000 or something.

[Jennifer Stoddart]

It's not even ISO; that's another privacy standard we're working on.

The privacy standard of the Government of Canada is probably medium; we think it should be high. It's probably medium, and what helps us is a strong historical appreciation of the value of privacy by the Canadian people across Canada.

However, it's being strongly and consistently eroded, as you mentioned, by national security, by technology, and by international pressures. You will see that the Secretary of Homeland Security recently said that fingerprints were not personal information, which is absolutely contrary to what is in the Privacy Act. That's letting alone the issue of gathering DNA, which is being debated internationally.

What is of medium.... Many countries don't even have these protections. I'm not saying Canada is far down the list, but the current mechanisms are quickly becoming more and more obsolete as these pressures on governments go ahead from technology, from international situations, from world alignments, from international trade, and so on. That's why I would urge you to look at least for some changes. We've really done our best to try to....

When I look at them, at least half of them are now Treasury Board policies that should be enshrined in the law, and we could provide you with more information if you choose to advance the study. It's not that there doesn't seem to be some consensus in government that this is necessary, but we would argue that Treasury Board policies are more likely to run the risk of being honoured in the breach. If the thinking is there, why don't we say it is the law that you do a privacy impact assessment? Why don't we say it is the law that before you send information abroad, you have to go through the privacy evaluation test Treasury Board has set up, etc.?

[Pat Martin, NDP, Winnipeg Centre, MB]

Correct. That seems eminently reasonable. And you hit on another point. Nowhere in your eight points do you recommend changing the definition of “personal information”. Or did I miss that? Or maybe that means harmonizing it with—

[Jennifer Stoddart]

Oh, yes, this has to do with the issue of recorded information, which is the DNA issue. It's recommendation 7.

[Pat Martin, NDP, Winnipeg Centre, MB]

Oh, right, number 7.

So the Privacy Act applies only to recorded information.

[Jennifer Stoddart]

Exactly.

[Pat Martin, NDP, Winnipeg Centre, MB]

If you change the definition of “personal information”, it may then include things like DNA and modern content.

[Jennifer Stoddart]

That's right. Some of the DNA banks could be under that level, which is of great concern to me.

[Pat Martin, NDP, Winnipeg Centre, MB]

That's an excellent point. The more you dig into this, the more you realize how overdue it is and how far behind we have slipped. You and the former Privacy Commissioner have tried to alert people to this problem, but there just hasn't been the political will to do the hard work that needs to be done.

That's all I have.

[The Chair, Liberal, Paul Szabo]

Mr. Hiebert.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Thank you, Ms. Stoddart, for being here today.

I noted in the opening statement that you distributed--but didn't have a chance to read--that you've retained a privacy expert to prepare a report on the Privacy Act reform. I was wondering if you could tell us who this expert is and when you would expect the report to be completed. We might want to take a look at it.

[Jennifer Stoddart]

The expert is Dr. David Flaherty, the former information and privacy commissioner of British Columbia. He is the author of a pioneering study on surveillance societies across the world. Assistant Privacy Commissioner D'Aoust is working on this.

When is it due, Mr. D'Aoust?

[Raymond D'Aoust]

Dr. Flaherty co-authored the 1987 report, “Open and Shut: Enhancing the Right to Know and the Right to Privacy”. So we asked Dr. Flaherty, who is on our external advisory committee, besides being a scholar and an expert in this area, to take stock and write a “20 years later” type of report on what he believes needs to be changed.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

When do you think it's going to be finished?

[Raymond D'Aoust]

We have a rough draft report that we reviewed two weeks ago. I believe the deliverable date is the end of June.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Would it be possible to see a draft of some kind, as we're in the middle of a study on this subject right now?

[Raymond D'Aoust]

I would defer to the commissioner.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

If we wait until the end of June, we might have run out of time to consider his recommendations.

[Jennifer Stoddart]

I'm not sure about a draft, but perhaps we could ask him to do an executive summary of his thoughts, which we could then present in both official languages, if the committee wishes. Or you could invite him as a witness. He's a very knowledgeable person.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

I think both ideas are good. All right, I'll ask the chair to proceed on both those fronts.

Ms. Stoddart, I have questions on three different subjects: identity theft, national security, and data matching.

On the issue of identity theft, you probably know that the government has introduced Bill C-27. It is designed to amend the Criminal Code so as to crack down on identity theft. You noted in your own report of 2006-07 that there are other ways to help prevent identity theft. Your report refers to “Privacy Act reforms requiring stronger protection of personal information held by government institutions”. I'm wondering if you could briefly expand on what you mean by “stronger protection”. How would you suggest we amend the Privacy Act to prevent identity theft?

[Jennifer Stoddart]

Can the assistant commissioner answer this?

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Of course.

[Raymond D'Aoust]

There is a firm by the name of Symantec. It is one of the best firms that monitor cyber attacks. A few years ago, they put out a report referring to an international survey of 30 or 40 countries. The report had apparently shown that 25% of information used for identity theft and fraud comes from government sources.

They didn't actually point to the federal government, but I suspect that this is probably the reality. Furthermore, this is not the work of hackers. Rather, it's an insider problem—people walking out the door with the information and abusing it.

In response to your question, I would suggest that the best way to tackle this problem would be to strengthen the security requirements around personal information holdings.

I receive incidence reports. An ADM will call to inform us that a laptop containing encrypted personal information has been stolen from an individual's house. That's not good enough—that's not the standard we want to have.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

I appreciate that.

On the issue of national security, you mentioned in your recent submission to the committee that you take issue with certain elements of the Anti-terrorism Act. One of your key recommendations is more oversight in the intelligence-gathering agencies. You speak of striking a better balance between protecting privacy and ensuring national security.

I'm wondering, based on your experience and your international contacts and studies, if you can give us some examples of where a more appropriate balance between these two elements is being practised.

Could you tell us what elements we could amend in the Privacy Act to address those concerns?

[Jennifer Stoddart]

I would have difficulty giving a useful answer to the first part of your question, Mr. Chairman. However, one of the recommendations, for example, in regard to the public security and emergency preparedness portfolio, particularly, where we first brought this up, mentions the idea of deputy ministers making an annual report on the privacy challenges and the privacy initiatives they have undertaken. I forget which recommendation it is.

When PSEPC was formed, I made the recommendation that given the amount of personal information washing through that department, it wasn't too much to ask the minister and the deputy minister to specifically report to Parliament on that. I think we could extend it now to most ministries.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

I should have mentioned that I agree with many of the recommendations you've made. I'm familiar with the one you just referred to. My question was focused more on whether any other countries are doing a better job of finding this balance. I would imagine it's a difficult balance to find.

Can you point to any nation that's doing a better job with this than we are?

[Jennifer Stoddart]

Well, that's where I said that without maybe some study, I couldn't give you a useful answer. Part of the difficulty in giving you a useful answer is because of what a privacy commissioner, who has basically the same status as a member of the public vis-à-vis foreign governments, doesn't know.

In terms of mechanisms, I know that my colleague, the U.K. commissioner, Richard Thomas, has been very active on this. I would call attention to the U.K., but the U.K. may not have the same security challenges as Canada. That is not information I'm privy to.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

That is fair enough.

On the subject of data matching, in your June 2006 report you suggest that there should be some reforms to the Privacy Act with respect to data matching. You use the example of CBSA matching data from Human Resources and tracking down people who are making EI claims but are outside the country. Obviously, there are examples of fraud.

When a government has limited resources, and those resources should be targeted to legitimate beneficiaries, are you suggesting that this kind of data sharing between CBSA and Human Resources, in this example, should not be occurring? Should the government not be in a position to match this data to prevent fraud?

You also suggest that we should define some principles that would help guide how we are allowed to match this data. What are some of the principles you're thinking of or suggesting?

[Jennifer Stoddart]

To the first part of your question about whether the government should not data match, particularly in that case, I don't think I'm saying the government should never data match. The issue that came up in that case, which I believe went to the Supreme Court and is known familiarly as the “snowbirds case”, was the fact that the public was unaware of that and did not know, in fact, that their actions and their information were being tracked and matched.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

The Supreme Court of Canada did uphold the government's decision to match this data. I'm not sure why their not being aware would offend their privacy. If they're defrauding the government, isn't it the government's obligation to make sure these possible fraudsters know they might be getting into trouble?

[Jennifer Stoddart]

Well, I'm trying to dissociate, I think, the two parts of your question and what happened in that case, which had to do with the expectation of privacy and the interpretation of the Privacy Act and the Customs Act as it then was. I'm saying to you that my predecessor contested that case and lost, obviously, because people did not expect that.

However, it's legitimate, I think, for the government to track fraud. It's legitimate, then, to take reasonable means to track fraud. The question is whether you take excessive means and whether people know about this and expect it, which goes to principles of transparency and open governments.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

And those would be the principles that you suggest would guide whether or not we allow this kind of data matching--

[Jennifer Stoddart]

The issues are as follows. Is the purpose legitimate? For example, I'm suggesting that tracking fraudsters is now accepted as legitimate. Do people know about it--unless, of course, it's a national security issue; that may be something different. Do they expect it? Do they have access rights? If I find that I've been wrongly data-matched with somebody else, somebody who has a similar name and so on, what can I do to contest this?

I suggest there is now very limited recourse for citizens in the act. But you've worked on data matching--

[Raymond D'Aoust]

The Treasury Board recognizes the need to review its data-matching policy, which dates back to 1989. A survey done by Treasury Board a few years ago demonstrated that there was very little understanding of that policy. That's the first problem. There's almost a kind of public servant education imperative here.

The second problem is that the policy, as it was defined in 1989, is very limited and very narrow. It allows for front-end and back-end types of matching, but it doesn't include new phenomena like data aggregation and data mining. Basically, there are private vendors selling data mining capacity, and governments are purchasing those services.

We believe a more expansive definition of data matching is needed. We've had repeated discussions with Treasury Board about that. I think they recognize the problem. However, we haven't seen any movement on a renewal of the data-matching policy. Our audit group has written to deputy heads, asking them about their data-mining practices, and we have gotten, I would say, very limited response. So that's an issue.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Thank you.

This is my last question, and it's a brief one.

In your opening comments you referenced social networking sites and gaming sites. I would have imagined that those would have been related more to PIPEDA. But what's the connection to the Privacy Act, other than what you just suggested--possible purchase of data mining from private sources used by the government? What's the connection between social networking sites and the Privacy Act?

[Jennifer Stoddart]

Do you mean in my spontaneous remarks of a few minutes ago?

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

That's correct.

[Jennifer Stoddart]

Well, it perhaps wasn't the greatest. It's a very good question. It's PIPEDA, in particular. In fact, we're looking at the reach of PIPEDA and the effect these gaming sites may have on privacy rights.

I'm not suggesting that we're going to touch gaming sites by reforming the Privacy Act. I was simply trying to say--I'm making a presentation on it on Monday--that many Canadians now, I realize from the research I did, live in a virtual world, a world in which their privacy rights are increasingly fragile. So it behooves us to make sure that in this world where they're often unaware of their privacy rights--we also know that only 25% of people on social networking sites use the privacy settings--some of us take the leadership to enhance their rights.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

As a closing comment, I completely concur. In fact, I had dinner with some students last night. They said that as high school students their number one issue with being on these social networking sites--and there are pressures and concerns--is that future employers or other sources might review this information who knows when in the future.

Thank you, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

I'm going to move to Mr. Tilson.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Mr. Chairman, thank you.

I kind of agree with Mr. Martin. This whole topic is very daunting, really. In this place alone, this complex of Parliament Hill, there are people with cameras on BlackBerrys, and everything is recorded. You can't breathe without being recorded. I mean, you literally have no privacy. People drive down streets with machines; they can figure out what you're saying on your laptop inside your house. I mean, it's incredible.

Then you look at the issues of privacy versus the right to information versus the obligation of a nation, Canada, to national security. The whole topic of transborder information, as I think you described it, is really incredible in terms of what we have to go through. You listed off 10 amendments.

Mr. Chairman, quite frankly, we may have to see some other witnesses about these 10 suggestions. We really haven't given the Privacy Commissioner an opportunity to elaborate on these points. We can all read them, but I expect she could give us a lecture on each one. They're difficult topics. If someone here were to ask us simple things, such as the definition of personal information, what does that mean?

I assume you've sat around and philosophized about that.

Mr. Chairman, I really don't have any questions, other than the fact that I believe we need some guidance from the commissioner and her staff on this. I don't know where you're going to fit it in, but I think they should come back again and we should spend some more time just listening to their suggestions, or even, just as a starter, to them elaborating on these 10 points.

I have no questions, just this observation to make.

[The Chair, Liberal, Paul Szabo]

All right. Well, I think there's a consensus. I think we're moving in the right direction, but we need to spend a little bit more time on this.

Ms. Stoddart, we had initially booked you for April 29, and then we said that we'd free up that date and that you could come and spend two hours with us today. I think we need to see you again. I think Mr. Tilson has a good suggestion, that you should have an opportunity to maybe make a brief, appropriate assessment on each of these items or recommendations. We need to know what is the strength or basis of, and what is your backup for, these recommendations. Where are these coming from? Are these recommendations just from your own little huddle or are they based on good practices in other jurisdictions? There are some raisons d'être for these, and I think we need to have your input on them to guide the committee.

We have not booked anybody for April 29. I know this is short notice, but if you have an hour for us, again from 3:30 to 5:30, or probably even two hours, if they are available, we'll take them.

The members are going to spend a little bit of time reflecting, because we've moved fairly quickly away from our original thinking because of the input we've had from you and others, but I think there are still some other areas the members may want to explore or to put into the bin for consideration.

You may also be able to suggest to us—minimally, at least—the people you would recommend as witnesses, whom we could call for corroboration or support of some of these recommendations. We'll probably look for witnesses on the other side of the case as well, but I think it's important that we get some third-party input.

Now, I've made a serious mistake here: I did not include Mr. Nadeau on the list, for some odd reason. But his name is there, and we still have five minutes left.

Mr. Nadeau, why don't you just start, sir.

[Richard Nadeau, Bloc, Gatineau, QC]

Mr. Chairman, I should have made loud noises to get your attention, but I was busy listening to the very interesting comments made by both my colleagues and our witnesses from the Office of the Privacy Commissioner. I found them very enlightening.

There are a couple of aspects that have been discussed here with respect to the ten suggestions you were making. If I'm not mistaken, Alberta, Ontario, Quebec and British Columbia all have privacy commissions. I think we should look at what is being done in those provinces, with a view to making improvements at this level. According to what I've read, their role is similar.

If someone in Nova Scotia wants to make a request of his provincial government, does he have to go through the Government of Canada? That is something you might want to look at, as a means of improving the legislation. That's what I wanted to say.

[The Chair, Liberal, Paul Szabo]

Do you have any comments?

[Jennifer Stoddart]

No, except in response to both questions,

I believe we have already sent the Committee clerk a list of witnesses you may wish to hear from.

If you want to look at the question of calling witnesses, I believe we've sent a list of witnesses already, given the short timeframe, Mr. Chairman.

Certainly, we would be very happy to come back on the 29th, and perhaps we could look at reorganizing some of the material here to facilitate its study by members and to explain why we've chosen these. Perhaps we should separate out things that are already government policy and that enshrining in law should not be too big a step. And we could make some comments on each of them.

Would that be...?

[The Chair, Liberal, Paul Szabo]

That would certainly be helpful. I guess you've made some further comments in your speaking notes that are not in the addendum. Maybe if you could just bring everything together—

[Jennifer Stoddart]

Yes, with the suggestions.

[The Chair, Liberal, Paul Szabo]

Now, one final item going back to our discussion on the estimates is very relevant to what we're talking about. In the debate this week in Parliament on the Judges Act, and so on, the issue came up that if you pass laws but don't have the resources to enforce them or to do them, then your laws are not very effective and not worth doing. I guess the point of that kind of thinking is that we can make all kinds of changes, but what are they going to do to help you achieve service standards? This, of course, also involves the human resources element.

So let me also invite you to come back to us again on the 29th with a few thoughts on the human resources plan. We'll have a chance to see where you are and to make some assessments, as I think we'd like to be in the loop on some of the preliminary thinking on how we're going to address that whole issue.

Are there any further matters from the committee?

Seeing none, we'll see you on April 29.

Thank you kindly to all.

The meeting is adjourned.