Information & Ethics Committee on April 29th, 2008

[Raymond D'Aoust]

That's correct. New Zealand is one of the countries that has the most significant experience in privacy impact studies. Its policy is extremely well developed. We very recently met with senators from the United Kingdom. We talked about evaluating privacy factors, and we sensed genuine interest in the Canadian experience in this area.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

So the grid exists and has already been used on a number of occasions. Is it currently being used by the people from your office, even though it is not yet in the act? You simply want to make the grid official.

[Raymond D'Aoust]

That's correct.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I would like to know what actually happens when the grid is used. If, for example, a department wants to gather personal information and someone asks whether it's really necessary, you then delegate someone with your grid, and you review the grid. Is that how it really happens? After answering the questionnaires and gathering all the information, is it possible that someone may say not to request a particular piece of information or any information? Is that possible?

[Raymond D'Aoust]

That actually happened in one case. I don't exactly remember the file. Information had been collected and the collection of one piece of information was questioned. The department ultimately reconsidered the entire matter and decided not to compile that information because it wasn't necessary.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

It was completely unnecessary.

[Raymond D'Aoust]

We think this dialogue is extremely useful because it enables us to get a clearer understanding of the program or policy in question and you have a dialogue that makes it possible to prevent privacy risks rather than correct the situation after the fact.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You say the grid exists for the private sector.

[Raymond D'Aoust]

No, it exists for the public sector.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

It exists for the public sector, but not for—

[Raymond D'Aoust]

It's only for the public sector.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

That's good.

[Raymond D'Aoust]

These are the principles.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I'd also like to go back to recommendation 7, which concerns recorded information. You wrote, and I quote:

The Act should be aligned with PIPEDA by eliminating the restriction that the Privacy Act applies only to “recorded” information. At the moment, for example, personal information contained in DNA and other biological samples is not explicitly covered.

That's on page 3.

[Raymond D'Aoust]

Yes.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I know you didn't put them in that order.

[Jennifer Stoddart]

The expression “recorded information” refers to the fact that the information must be transferred onto a sheet; it's a form of coding, in a way. This increasingly causes definition problems, particularly when we're dealing with human tissue, DNA in particular. It isn't necessary for the material to be recorded or written; it's the information in itself. In one sense, there's nothing more private than DNA. However, it's not clear that it's included in that definition.

[Raymond D'Aoust]

To add to what Ms. Stoddart just said, let's consider, for example, the collection of genetic fingerprints for criminal investigation purposes, in other words the genetic data base for identifying criminals. The DNA sample as such would not be covered by the act, whereas the profile contained in CODIS, which makes it possible to determine whether an individual has committed a crime based on elements left at the scene of the crime, would be protected. We think the definition should be expanded to include biological samples as well.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I simply want to understand and put that in context. That would mean that someone who would want information, such as a list of inmates, couldn't obtain it, but could obtain a DNA sample. Is that what you want to change?

[Raymond D'Aoust]

No, because the act doesn't allow that. There is an act that concerns that data base. However, we've had cases involving the recording of voices and the non-recording of voices. If we had a camera that didn't record, it wouldn't be currently subject to the act.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Martin, please.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you, Chair.

Thank you, Madam Stoddart, and also thank you for sounding the alarm as to just how badly we need to reform the Privacy Act. The more I read, the more I'm convinced that we've let this go far, far too long. This is badly overdue.

I just came across one paragraph you wrote in a report earlier this month, April 2008, where you said:

The Privacy Act is at the hub of the informational relationship between state agencies and individuals. If the legislative framework that governs this relationship is weak, the entire edifice of accountability is undermined. Privacy is too important to be left to the vagaries of internal policy and management.

I think that sums it up very well for us.

One of the things you cited or made reference to in this document is the need to make the first-ever special report to Parliament regarding the RCMP's exempt data banks. I think this opened the eyes of a lot of Canadians, when you found that more than half of the files examined as part of your audit did not properly belong in exempt banks at all. This one case demonstrated or graphically illustrated for Canadians how your right to privacy is being compromised or perhaps not protected adequately, which is what I'm getting at.

In the little time I have, could I concentrate on your recommendation ten? I'm starting at the back, and thank you also for these easy-to-follow recommendations. I think that will save the committee a great deal of time.

You cite examples where the cross-border flow of information is frequent and common and wasn't even contemplated perhaps 25 years ago when the act was written, the Canada Border Services Agency sharing information about travellers; and FINTRAC, the Financial Transactions and Reports Analysis Centre, has 40 agreements with other financial intelligence units.

You're saying that the Privacy Act currently doesn't impose any duty on the disclosing institution to identify the precise purpose for which the data would be disclosed or limit its subsequent use by foreign governments for that purpose. Can you expand on what changes we would make to the act to tighten that up?

[Jennifer Stoddart]

Yes. Here, although this may seem a huge change, I did underline in my presentation that in fact appropriate rules already exist in a policy that was devised in consultation with us by Treasury Board, and that is a policy. So in saying these are things that should be fairly easy to adopt in a law, if they're a policy, why wouldn't they be our law?

[Pat Martin, NDP, Winnipeg Centre, MB]

Why shouldn't we codify them and put them into legislation?

[Jennifer Stoddart]

Exactly, and give it that importance. So these rules, which can be consulted—Treasury Board publishes them—lay out specific guidelines, such as is it necessary to send the information abroad? Is there no other—