Information & Ethics Committee on April 17th, 2008

[Raymond D'Aoust]

We believe these changes would mean that the public sector legislation would provide for the same level of protection as what exists in the private sector. That is a very strong argument in their favour. Essentially, why should our rights, in terms of the relationship between citizens and government, be any less protected than they are for consumers dealing with merchants?

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

In terms of cross-border information exchange, what exactly are you recommending?

[Raymond D'Aoust]

If you don't mind, I would like to tell you about the work carried out by the Treasury Board in that regard. It has established guidelines on information sharing in the context of agreements federal government departments have signed with public partners.

We would like there to be an in-depth review of this whole area. Let me give you an example. We are in the process of doing an audit, and the information-sharing agreements run in the hundreds in one department in particular. We have not yet completed that study. So, I would like to keep the identity of the department confidential.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

There are hundreds of agreements—for example, with the United States.

[Raymond D'Aoust]

Yes, or with other levels of government, private partners, and so on. We are wondering who is in charge and who has an oversight role in terms of all these information-sharing agreements. This is not a new issue. I just want to point out that in 1987, a standing committee looked at this. It devoted an entire chapter to transborder or trans-organization data flows. There was an awareness of the issue in 1987. The committee suggested a number of amendments to the Act at the time, but they were never implemented.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Are you recommending that there be a single, standard agreement?

[Raymond D'Aoust]

Yes, I think so. We need a framework for managing these agreements. At the present time, the Act is silent on this.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Yes, totally silent.

[Raymond D'Aoust]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You say that you would like there to be a single agreement. What would be in that agreement? How would information be exchanged?

[Raymond D'Aoust]

For example, there need to be very specific standards with respect to information security, as well as restrictions on secondary uses of that information—in other words, so that it cannot be put together with information from other data banks for verification purposes. They have to be very clear parameters with respect to the use of Canadians' personal information.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Thank you.

Mr. Chairman, do I have any time left?

[The Chair, Liberal, Paul Szabo]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You were not given an opportunity earlier to present each of the changes you are suggesting, but I am interested in hearing your explanation. In the time remaining, I would like you to explain the first change. If I have any time left after that, we can move on to the second change.

[Jennifer Stoddart]

I already presented it.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You talked about demonstrating the need to collect personal information.

[Jennifer Stoddart]

The Assistant Commissioner has just been talking about the principle that underlies the second change we are requesting. That is, the ability to take one's case to the Federal Court on any ground, and not only because you have been refused access to your file. In addition, we are proposing to entrench in the legislation the obligation—which already exists under Treasury Board Guidelines—to carry out privacy impact assessments prior to implementing new programs and policies. This is nothing new. It is simply a matter of enshrining it into law. The fourth change is not new either. The current Act does not give us the mandate to get involved in public education.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You mean training.

[Jennifer Stoddart]

Yes, exactly. We do a little of it.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

If you don't mind, I would like to backtrack for a minute. I want to be sure I understand the third change that is being suggested. It's very nicely written, but it is not particularly clear. You talk about carrying out privacy impact assessments. However, I don't understand what that means.

[Raymond D'Aoust]

Let me explain, Ms. Lavallée. In 2002, the Canadian government, through the Treasury Board, introduced a policy on privacy impact assessments. In English, it is called

privacy impact assessment.

All deputy heads…

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

An assessment of privacy impacts.

[Raymond D'Aoust]

Yes, exactly.

We conducted an in-depth audit of the way that policy is being applied, and realized, first of all, that it is very uneven. Second, impact assessments are often conducted after a program has been introduced, which gives us very little opportunity to manage the risks. Third, we believe that entrenching that obligation in the Act would make for a more effective and efficient policy.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Martin is next, and then Mr. Hiebert.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you.

I think you've given us a realistic and achievable road map. It's very helpful, because what we have been wrestling with as a committee is whether we have the time and the resources to do a comprehensive review of the entire act.

Given other interests--reviewing the Access to Information Act and other things--I doubt we could do a thorough job in the time we might have left in this minority Parliament even. I think these eight points, and number 9 and number 10, as you've recommended, are an excellent starting point.

I'm wrestling with the larger issue that maybe personal privacy is a luxury we just cannot afford. It's an expectation that's obsolete in today's....

I'm not trying to be controversial here, but even in your first recommendation, you remind us that in some jurisdictions, governments shouldn't be collecting information unless there's a demonstrable need for each piece of personal information. Under our national security act, doesn't that mean everything? When I see national security butting up against the right to privacy, it really worries me that privacy is going to lose every time, at least in the current environment. I'm really concerned on the larger scale that personal privacy might be roadkill on the road to the new national security environment.

Having said that, I was flipping through the “Terra Incognita” document, which was interesting, and I came across a chapter on privacy seals. It talks about trust marks in commercial operations and, if you want to deal with these commercial companies, what Good Housekeeping seal of guarantee of privacy they may be offering.

What do you think the Government of Canada's privacy seal should be? What level of privacy can we reasonably guarantee to Canadians, and how would that compare?