Information & Ethics Committee on May 6th, 2008

[Philippa Lawson]

We need to be very careful before expanding police powers. We have over the years, and child pornography is just the latest thing the police are going after. But the police have the same kind of technology available to them as the criminals do, and they are using it and successfully prosecuting right now.

I'm not sure that the police need any greater powers to do their job in this area or any other area. Due process is absolutely essential. We have due process in the Criminal Code right now to ensure that the police have the powers they need but are not allowed to go any further. In the interest of civil liberties, and the innocent people and everyone using the Internet, we need to be extremely careful before we give the police expanded powers because we want to shut down this horrible crime.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I'm not suggesting expanding powers right across the spectrum. In an area like child pornography, can you see where we could possibly make some amendments so police have better access to those who are using these avenues to propagate this?

[Philippa Lawson]

As I said, I'm not convinced. This is a live issue that we've looked at a bit at the clinic. I'm not convinced that the police need greater powers to do that job, if that's what you're suggesting. The current legislation allows Internet service providers to hand over information about you, me, and anyone to the police upon request without a warrant. I think we need to be careful before we require them to do so.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

They're being told by their own lawyers that if they do this they might be infringing on people's rights--with the Internet providers.

[Philippa Lawson]

Right. This is not a Privacy Act issue. As I say, I think that's about as far as we should go in assisting the police in their investigations in this area.

[The Chair, Liberal, Paul Szabo]

Colleagues, we have another witness. There is also a notice of motion that's in order. I haven't had a chance to talk with Madame Lavallée. Maybe we can use the last 10 minutes, if everybody wants to cooperate.

Mr. Hubbard and Mr. Wilson, why don't you carry on? Then we'll have Madame Lavallée and Mr. Nadeau.

[Charles Hubbard, Liberal, Miramichi, NB]

In our discussions today we're covering a very broad range on privacy. If we are just dealing with our federal government in terms of privacy--the agencies and departments of the federal government--and the title of your group is the Canadian Internet Policy and Public Interest Clinic, is there sufficient security? Several dozen departments and government agencies out there have computer banks that contain information. From your study of this, is there sufficient security of that information to protect the privacy of individuals?

[Philippa Lawson]

Of course, my small clinic has not done, and doesn't have the resources to do, any kind of audit of government agencies. That's a job for the Auditor General and the Privacy Commissioner. We have reviewed the news reports and Privacy Commissioner reports to try to get a sense of how many breaches there have been. For example, in the past year, how often have government agencies unwittingly released information or suffered a hack or a security breach? We're seeing them fairly regularly.

There were a few in the past year. Canada Post suffered one, and a few federal agencies. There is human error and these things happen. That is why I think the earlier point is a good one, that the more information you have stored in these data banks and the more data banks you have, it's almost inevitable that there will be some level of breach.

I guess in response to the question, it's hard to know. I can't say how adequate the levels of security are right now. I would rely on the Privacy Commissioner to assess that. But I think it would help to have legislated requirements so that there's a stronger incentive for government institutions to take those security measures.

[Charles Hubbard, Liberal, Miramichi, NB]

With the departments, I'm often amazed to find sometimes--when we do get waivers on privacy--how much information departments have on individuals. For example, some departments would say, “That particular person has called our office 17 times in the last three years.” And they have a list of the dates, the hour, and the subject that was discussed, and often the answer that some public servant would offer to that person.

Are you aware of that type of information being available? We might comment on Madam Lawson and say, “What has her connection been with Human Resources and Social Development Canada or Service Canada?” And some bureaucrat can say, “Well, she's been calling and....”

[Philippa Lawson]

No, I'm not aware of the extent--

[Charles Hubbard, Liberal, Miramichi, NB]

You're not aware of the stories.

[Philippa Lawson]

--of that, but I think it is an example of why it's so important that we limit data matching among government institutions and that we don't allow for these monster databases that combine all of this information so that a civil servant in one department is able to access information he or she doesn't need.

[Charles Hubbard, Liberal, Miramichi, NB]

In your review--for example, in dealing with the RCMP--have you ever had occasion to request the information that the RCMP or CSIS have on you, or some individual in your organization, to see what they have?

[Philippa Lawson]

I have not done that, and I'm not aware of anyone in CIPPIC having made an access to information request for personal information about me or them as individuals. We have made other requests, but not for that kind of information.

[Charles Hubbard, Liberal, Miramichi, NB]

It appears, in some of these more serious cases, that either CSIS or the RCMP have had data files on people that they were not aware of. Later on, in terms of investigating by Mr. O'Connor, or in terms of a court, they can suddenly bring forward information. And even then CSIS can say, “Well, that's against the best interest of the public safety of our country; we therefore can't....”

Should there be availability to people to access their files?

[Philippa Lawson]

Yes, absolutely. And I note that the Privacy Commissioner did an audit, or reviewed the RCMP's exempt databases, and I think she found that more than half of the information in those so-called exempt databases should not have been in there, should not have been exempt from access to information requests.

So I think we do have a problem there. It's a transparency problem again, and it shows that we need a Privacy Commissioner with enough resources and powers to call the government to account on these types of things.

[The Chair, Liberal, Paul Szabo]

Mr. Tilson.

[David Tilson, Conservative, Dufferin—Caledon, ON]

On the issue of the public not wanting to provide information and the issue of the government needing information.... I don't know how often it happens, but I had a constituent call me at my office and he said--and you know this issue--Statistics Canada wants to know how much he makes and all the financial information about him, for labour purposes, and he doesn't want to give it. Statistics Canada says, “Well, if you don't give it, we're going to come and get you.” They don't say that, of course, but there are charges that can be laid.

Statistics Canada says for them to properly advise the government of the day, to provide information for economic purposes and for labour purposes, and I suppose for other purposes I can't think of right now, they need to have that information to properly advise whoever is in office. Otherwise, the government can't develop policy. They can't develop labour policy; they can't develop economic policy.

Has your clinic got into the philosophy of that? I can understand the guy saying, “I don't want you to know how much I make.” I suppose if they got his income tax they could look that up, but they want to know all kinds of other things.

[Philippa Lawson]

CIPPIC has not looked at that information, but it has come to me. I can think of a couple of cases in which people have complained about exactly that issue, about providing detailed, sensitive, personal information to Statistics Canada, people who didn't want to. I believe there are a number of people who have filed formal complaints with the Privacy Commissioner about that, but as you say, there is a law requiring them to provide the information. It would be interesting to hear from Statistics Canada and the Privacy Commissioner on this issue. I've not looked at it in any depth, other than what the law requires right now.

The way it is at least theoretically resolved now is that there are theoretically constraints on Statistics Canada, so it does not allow that information to be used or abused in other ways. In the end, Statistics Canada produces very valuable information for Canadians and the government on the basis of the census and labour force surveys. There is a rationale for that, which I think has some merit, but the short answer to your question is that neither the clinic nor I have looked at it in any greater depth.

[David Tilson, Conservative, Dufferin—Caledon, ON]

Mr. Chairman, am I finished? Can I ask another question?

[The Chair, Liberal, Paul Szabo]

Absolutely. You actually have two minutes left.

[David Tilson, Conservative, Dufferin—Caledon, ON]

I have one other question, then. It has to do with recommending the order-making powers that you suggested for the commissioner. I think the commissioner has in the past agreed with that. She said she wants that. The former Information Commissioner, Mr. Reid, said he didn't want that.

We start looking at powers, and you mentioned the nervousness about giving the police too much power. Now we're saying, on the other hand, let's give the commissioner more powers, which I assume are quasi-judicial powers. I don't know what that means. That's like setting up a separate board. It would cost a whole whack of money. Does that mean the courts wouldn't be involved? She would make an order and that's that, without any reference to appeal?

We've talked about this issue in different areas. I did find interesting your comment that you didn't want to give the police more powers but that you want to give the commissioner more powers.

[Philippa Lawson]

There are a few things in there. First of all, on the issue of the police versus the Privacy Commissioner, those are completely different kinds of powers we're talking about. When we're talking about the police, we're talking about investigatory powers. The Privacy Commissioner, under the Privacy Act, already has pretty extensive investigatory powers, and I don't think those are at issue in this context. We're just talking about the ability for her to make more than recommendations, to basically turn her recommendations into binding orders. That does not mean there would be no role for court. It would simply mean two things. The Privacy Commissioner's recommendation--

[David Tilson, Conservative, Dufferin—Caledon, ON]

Just so I'm clear, you would prefer that there be a quasi-judicial system under the Privacy Commissioner's jurisdiction, as opposed to going directly to the courts?

[Philippa Lawson]

I'm saying that it would be in addition to going to them, so you could go to the courts after. You go to the Privacy Commissioner first, and instead of just getting a recommendation--