Information & Ethics Committee on May 1st, 2008

[Luc Harvey, Conservative, Louis-Hébert, QC]

Let's suppose someone discloses a list of information including 250,000 social insurance numbers with names and a set of information. Are there any fines? Can a citizen say that you lost his personal information and that there will be costs? There's also increasing talk about identity theft. That's what I want to get to, identity theft. If we can't protect those who have information... When I buy a car, I don't have the choice of whether to say who I am in order to get the keys. I have to give my name, my address, my telephone number, my mother's name, my bank account number and my social insurance number. That's normal; a $30,000 vehicle is being entrusted to me. Once the dealer has that information, which I give it confidentially, if it isn't careful enough—

[Donald Lemieux]

No criminal penalties are provided for in the policies, whether it's ours or that of Service Canada.

[Luc Harvey, Conservative, Louis-Hébert, QC]

Does a citizen have any recourse against the business?

[Donald Lemieux]

That's not my field, the field of the policy—

[Luc Harvey, Conservative, Louis-Hébert, QC]

Would it be good for there to be one?

[Donald Lemieux]

You're talking about a theft, a crime. That's a justice matter. If someone steals an identity or does something illegal with personal information belonging to someone else, I would say that is more of a Criminal Code matter. The RCMP or the police would conduct an investigation, if there was a theft or some form of abuse. That's straying a little from my area of responsibility.

[Luc Harvey, Conservative, Louis-Hébert, QC]

Do you feel you have the necessary tools to control identity theft? Ultimately, if you don't have enough information on an individual, you don't know whether it's him or someone else who is before you. You are entitled to some information that is relatively easy to find, but, as for the rest, you don't know whether it's really Luc Harvey who's talking to you on the telephone or who appears before you to apply for a passport. So what tools do you have, or what tools would you need to ensure that it is indeed the right individual, the one you should be dealing with, or the one who says he bears a certain name. I bear the name of Luc Harvey, and I can prove it, but someone else could come and call himself Luc Harvey as well.

[Donald Lemieux]

I believe Mr. Cochrane would like to add something regarding identity theft.

[Ken Cochrane]

May I answer in English?

[Luc Harvey, Conservative, Louis-Hébert, QC]

Yes, there's no problem with that.

[Ken Cochrane]

In the area you're talking about, if there were to be sanctions or whatever, PIPEDA needs to deal with that with respect to private industry. As Mr. Lemieux says, it's a criminal matter when information is stolen, so we're into the criminal side of this process.

Identity is an area we're also engaged in on behalf of the Government of Canada. It's a new area. Different institutions determine the information required to verify that you are who you say you are and I am who I say I am. We're working collectively on identity standards across the country, with all the jurisdictions. We're also speaking to the banks and others about identity standards. Is my social insurance number, my driver's licence, and my passport sufficient to identify me? It's an area we're very active in right now. I don't have a solid answer. I can't tell you three things we'll accept.

It's all part of registering and establishing the person. We're a little outside of our discussion here. But registering and establishing a person is the most important part of the process. As an institution, you need to determine that you're satisfied that this is Mr. Lemieux. Once you've done that, we have tools we will put in place as part of identity management.

[Luc Harvey, Conservative, Louis-Hébert, QC]

Should that be defined? That's my question. Do you have everything you need? We know that fingerprints are roughly 92% effective, because there are certain problems. With voice, we're getting to an effectiveness rate of roughly 30%. Retinal identification has a much higher rate, and for DNA, it's even higher.

[Ken Cochrane]

I agree. It's a leading-edge area for all of us: the Americans, the British, the banks, and everyone else. It's an area we're very active in. The possibility exists that we will put some controls in place. From a policy perspective, what that means in terms of legislation--

[An hon. member]

You'd be happy if she didn't.

[The Chair, Liberal, Paul Szabo]

Mr. Hubbard had a brief item.

[Charles Hubbard, Liberal, Miramichi, NB]

Within the public service, there are tens of thousands of employees who have accessed different types of information. In your policies, how do you ensure that employees of the government do not divulge, lose, or carelessly leave information? What happens when they do? Is there a policy? I don't want a long description. Is there a policy to deal with people who handle other people's private information?

[Donald Lemieux]

Like so many of these things, it cuts across a bunch of areas. If you're talking about federal public servants, you already have some human resources issues if someone is mishandling information. Employees have clearances so that they can handle information at a certain level. It breaks down into Protected A, Protected B, Protected C, Secret, Top Secret, and that kind of thing. As an employee, you're limited in what you have access to. If you don't have access to that information, or you shouldn't have access and you do, then perhaps there's a sanction from a human resources perspective.

There are also various disciplinary measures. If someone has access who has committed an offence, we're looking at the Criminal Code.

[Charles Hubbard, Liberal, Miramichi, NB]

So you do have policies and you do have classifications and material on people with different security...?

[Donald Lemieux]

Absolutely. It cuts across security, privacy. If there's a breach, it's a Criminal Code offence. It could be a number of things.

[Ken Cochrane]

There is policy around the use of electronic networks, which really allows people to have access to systems and so on, so there are very strict policies.

[Charles Hubbard, Liberal, Miramichi, NB]

You do have strict policies.

The only other observation, Mr. Chair, would be that if we are making recommendations on this legislation, as Mr. Wallace said, we vet this back through your organization, so we don't get involved in something that is a problem for everybody.

Maybe, Mr. Chair, we'd want to take and look at it before we conclude our report and make sure Mr. Cochrane and Mr. Lemieux have at least a chance to have some input on what we suggest in terms of what we already see from the commissioner.

Thank you, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

Thank you. Good.

Mr. Wallace.

[Mike Wallace, Conservative, Burlington, ON]

One of the recommendations—and I don't expect you to comment on the recommendation—is:

The Act should be strengthened with respect to the provisions governing the disclosure of personal information by the Canadian government to foreign states. Treasury Board Secretariat (TBS) has taken some important steps by providing guidance on information sharing agreements and outsourcing of personal data processing.

And then she goes on to say:

However, we need privacy protections related to cross-border information sharing enshrined into law.

Can you just tell me, in sort of a thumbnail approach, in terms of providing guidelines and information on information sharing agreements and outsourcing, what you provide departments on information that might be shared across the border now? What exists now?

[Donald Lemieux]

Mr. Chair, there are a couple of things I'd mention on that front.

First of all, there's the work we did at the Treasury Board Secretariat going back a couple of years now, maybe three years, on the U.S.A. Patriot Act. There had been a complaint in B.C. regarding some employees, and the federal government became engaged because we were talking about the transfer of personal information. We got involved, our division got involved—because of its policy role in terms of sharing personal information—in developing some tools, some guidelines for government institutions when it comes to contracting and sharing information. We worked very closely with the Privacy Commissioner, and we issued a report, I believe just over a year ago maybe—years seem to come and go pretty quickly here—called Privacy Matters, in which we gave pretty solid policy direction on what should be done.

We're also working on additional guidelines and advice on transborder data flow. We've actually shared a document with the Privacy Commissioner on issuing guidelines on that, and we're still going back and forth. It's obviously an area that's sensitive, and I think everyone's aware of that, so we're just trying to be as careful as we can.

[Mike Wallace, Conservative, Burlington, ON]

That document was called Policy Matters?