Information & Ethics Committee on April 17th, 2008

[Jennifer Stoddart]

I would have difficulty giving a useful answer to the first part of your question, Mr. Chairman. However, one of the recommendations, for example, in regard to the public security and emergency preparedness portfolio, particularly, where we first brought this up, mentions the idea of deputy ministers making an annual report on the privacy challenges and the privacy initiatives they have undertaken. I forget which recommendation it is.

When PSEPC was formed, I made the recommendation that given the amount of personal information washing through that department, it wasn't too much to ask the minister and the deputy minister to specifically report to Parliament on that. I think we could extend it now to most ministries.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

I should have mentioned that I agree with many of the recommendations you've made. I'm familiar with the one you just referred to. My question was focused more on whether any other countries are doing a better job of finding this balance. I would imagine it's a difficult balance to find.

Can you point to any nation that's doing a better job with this than we are?

[Jennifer Stoddart]

Well, that's where I said that without maybe some study, I couldn't give you a useful answer. Part of the difficulty in giving you a useful answer is because of what a privacy commissioner, who has basically the same status as a member of the public vis-à-vis foreign governments, doesn't know.

In terms of mechanisms, I know that my colleague, the U.K. commissioner, Richard Thomas, has been very active on this. I would call attention to the U.K., but the U.K. may not have the same security challenges as Canada. That is not information I'm privy to.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

That is fair enough.

On the subject of data matching, in your June 2006 report you suggest that there should be some reforms to the Privacy Act with respect to data matching. You use the example of CBSA matching data from Human Resources and tracking down people who are making EI claims but are outside the country. Obviously, there are examples of fraud.

When a government has limited resources, and those resources should be targeted to legitimate beneficiaries, are you suggesting that this kind of data sharing between CBSA and Human Resources, in this example, should not be occurring? Should the government not be in a position to match this data to prevent fraud?

You also suggest that we should define some principles that would help guide how we are allowed to match this data. What are some of the principles you're thinking of or suggesting?

[Jennifer Stoddart]

To the first part of your question about whether the government should not data match, particularly in that case, I don't think I'm saying the government should never data match. The issue that came up in that case, which I believe went to the Supreme Court and is known familiarly as the “snowbirds case”, was the fact that the public was unaware of that and did not know, in fact, that their actions and their information were being tracked and matched.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

The Supreme Court of Canada did uphold the government's decision to match this data. I'm not sure why their not being aware would offend their privacy. If they're defrauding the government, isn't it the government's obligation to make sure these possible fraudsters know they might be getting into trouble?

[Jennifer Stoddart]

Well, I'm trying to dissociate, I think, the two parts of your question and what happened in that case, which had to do with the expectation of privacy and the interpretation of the Privacy Act and the Customs Act as it then was. I'm saying to you that my predecessor contested that case and lost, obviously, because people did not expect that.

However, it's legitimate, I think, for the government to track fraud. It's legitimate, then, to take reasonable means to track fraud. The question is whether you take excessive means and whether people know about this and expect it, which goes to principles of transparency and open governments.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

And those would be the principles that you suggest would guide whether or not we allow this kind of data matching--

[Jennifer Stoddart]

The issues are as follows. Is the purpose legitimate? For example, I'm suggesting that tracking fraudsters is now accepted as legitimate. Do people know about it--unless, of course, it's a national security issue; that may be something different. Do they expect it? Do they have access rights? If I find that I've been wrongly data-matched with somebody else, somebody who has a similar name and so on, what can I do to contest this?

I suggest there is now very limited recourse for citizens in the act. But you've worked on data matching--

[Raymond D'Aoust]

The Treasury Board recognizes the need to review its data-matching policy, which dates back to 1989. A survey done by Treasury Board a few years ago demonstrated that there was very little understanding of that policy. That's the first problem. There's almost a kind of public servant education imperative here.

The second problem is that the policy, as it was defined in 1989, is very limited and very narrow. It allows for front-end and back-end types of matching, but it doesn't include new phenomena like data aggregation and data mining. Basically, there are private vendors selling data mining capacity, and governments are purchasing those services.

We believe a more expansive definition of data matching is needed. We've had repeated discussions with Treasury Board about that. I think they recognize the problem. However, we haven't seen any movement on a renewal of the data-matching policy. Our audit group has written to deputy heads, asking them about their data-mining practices, and we have gotten, I would say, very limited response. So that's an issue.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

Thank you.

This is my last question, and it's a brief one.

In your opening comments you referenced social networking sites and gaming sites. I would have imagined that those would have been related more to PIPEDA. But what's the connection to the Privacy Act, other than what you just suggested--possible purchase of data mining from private sources used by the government? What's the connection between social networking sites and the Privacy Act?

[Jennifer Stoddart]

Do you mean in my spontaneous remarks of a few minutes ago?

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

That's correct.

[Jennifer Stoddart]

Well, it perhaps wasn't the greatest. It's a very good question. It's PIPEDA, in particular. In fact, we're looking at the reach of PIPEDA and the effect these gaming sites may have on privacy rights.

I'm not suggesting that we're going to touch gaming sites by reforming the Privacy Act. I was simply trying to say--I'm making a presentation on it on Monday--that many Canadians now, I realize from the research I did, live in a virtual world, a world in which their privacy rights are increasingly fragile. So it behooves us to make sure that in this world where they're often unaware of their privacy rights--we also know that only 25% of people on social networking sites use the privacy settings--some of us take the leadership to enhance their rights.

[Russ Hiebert, Conservative, South Surrey—White Rock—Cloverdale, BC]

As a closing comment, I completely concur. In fact, I had dinner with some students last night. They said that as high school students their number one issue with being on these social networking sites--and there are pressures and concerns--is that future employers or other sources might review this information who knows when in the future.

Thank you, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

I'm going to move to Mr. Tilson.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Mr. Chairman, thank you.

I kind of agree with Mr. Martin. This whole topic is very daunting, really. In this place alone, this complex of Parliament Hill, there are people with cameras on BlackBerrys, and everything is recorded. You can't breathe without being recorded. I mean, you literally have no privacy. People drive down streets with machines; they can figure out what you're saying on your laptop inside your house. I mean, it's incredible.

Then you look at the issues of privacy versus the right to information versus the obligation of a nation, Canada, to national security. The whole topic of transborder information, as I think you described it, is really incredible in terms of what we have to go through. You listed off 10 amendments.

Mr. Chairman, quite frankly, we may have to see some other witnesses about these 10 suggestions. We really haven't given the Privacy Commissioner an opportunity to elaborate on these points. We can all read them, but I expect she could give us a lecture on each one. They're difficult topics. If someone here were to ask us simple things, such as the definition of personal information, what does that mean?

I assume you've sat around and philosophized about that.

Mr. Chairman, I really don't have any questions, other than the fact that I believe we need some guidance from the commissioner and her staff on this. I don't know where you're going to fit it in, but I think they should come back again and we should spend some more time just listening to their suggestions, or even, just as a starter, to them elaborating on these 10 points.

I have no questions, just this observation to make.

[The Chair, Liberal, Paul Szabo]

All right. Well, I think there's a consensus. I think we're moving in the right direction, but we need to spend a little bit more time on this.

Ms. Stoddart, we had initially booked you for April 29, and then we said that we'd free up that date and that you could come and spend two hours with us today. I think we need to see you again. I think Mr. Tilson has a good suggestion, that you should have an opportunity to maybe make a brief, appropriate assessment on each of these items or recommendations. We need to know what is the strength or basis of, and what is your backup for, these recommendations. Where are these coming from? Are these recommendations just from your own little huddle or are they based on good practices in other jurisdictions? There are some raisons d'être for these, and I think we need to have your input on them to guide the committee.

We have not booked anybody for April 29. I know this is short notice, but if you have an hour for us, again from 3:30 to 5:30, or probably even two hours, if they are available, we'll take them.

The members are going to spend a little bit of time reflecting, because we've moved fairly quickly away from our original thinking because of the input we've had from you and others, but I think there are still some other areas the members may want to explore or to put into the bin for consideration.

You may also be able to suggest to us—minimally, at least—the people you would recommend as witnesses, whom we could call for corroboration or support of some of these recommendations. We'll probably look for witnesses on the other side of the case as well, but I think it's important that we get some third-party input.

Now, I've made a serious mistake here: I did not include Mr. Nadeau on the list, for some odd reason. But his name is there, and we still have five minutes left.

Mr. Nadeau, why don't you just start, sir.

[Richard Nadeau, Bloc, Gatineau, QC]

Mr. Chairman, I should have made loud noises to get your attention, but I was busy listening to the very interesting comments made by both my colleagues and our witnesses from the Office of the Privacy Commissioner. I found them very enlightening.

There are a couple of aspects that have been discussed here with respect to the ten suggestions you were making. If I'm not mistaken, Alberta, Ontario, Quebec and British Columbia all have privacy commissions. I think we should look at what is being done in those provinces, with a view to making improvements at this level. According to what I've read, their role is similar.

If someone in Nova Scotia wants to make a request of his provincial government, does he have to go through the Government of Canada? That is something you might want to look at, as a means of improving the legislation. That's what I wanted to say.

[The Chair, Liberal, Paul Szabo]

Do you have any comments?

[Jennifer Stoddart]

No, except in response to both questions,

I believe we have already sent the Committee clerk a list of witnesses you may wish to hear from.

If you want to look at the question of calling witnesses, I believe we've sent a list of witnesses already, given the short timeframe, Mr. Chairman.

Certainly, we would be very happy to come back on the 29th, and perhaps we could look at reorganizing some of the material here to facilitate its study by members and to explain why we've chosen these. Perhaps we should separate out things that are already government policy and that enshrining in law should not be too big a step. And we could make some comments on each of them.

Would that be...?

[The Chair, Liberal, Paul Szabo]

That would certainly be helpful. I guess you've made some further comments in your speaking notes that are not in the addendum. Maybe if you could just bring everything together—

[Jennifer Stoddart]

Yes, with the suggestions.

[The Chair, Liberal, Paul Szabo]

Now, one final item going back to our discussion on the estimates is very relevant to what we're talking about. In the debate this week in Parliament on the Judges Act, and so on, the issue came up that if you pass laws but don't have the resources to enforce them or to do them, then your laws are not very effective and not worth doing. I guess the point of that kind of thinking is that we can make all kinds of changes, but what are they going to do to help you achieve service standards? This, of course, also involves the human resources element.

So let me also invite you to come back to us again on the 29th with a few thoughts on the human resources plan. We'll have a chance to see where you are and to make some assessments, as I think we'd like to be in the loop on some of the preliminary thinking on how we're going to address that whole issue.

Are there any further matters from the committee?

Seeing none, we'll see you on April 29.

Thank you kindly to all.

The meeting is adjourned.