Information & Ethics Committee on May 15th, 2008

[The Chair, Liberal, Paul Szabo]

Colleagues, we're here with regard to our order of the day, Privacy Act reform.

We do have a couple of witnesses today, but before we commence with the witnesses--we still have a couple of colleagues who have yet to come--it's been raised with me about the witnesses we have had.

As you know, when we started this process we wanted to consult with the Privacy Commissioner about what was possible for us to do in the timeframe leading up to the summer break. As a consequence of our realizing it was going to take three months or more to do the full review of the Privacy Act, we came to the conclusion that we would be better advised to use our time to look for the quick fix, the band-aid approach.

As a consequence, the commissioner provided us with ten suggestions--an excellent paper--to give us a start. We have been providing witnesses with that document, and asking them to provide us their input on the quick fixes or the band-aids that have been identified by the commissioner, as well as any other suggestions they may have.

The remaining witnesses that we've committed to are the justice department officials, the minister and officials; that will be a full meeting. We also have the bar association and the commissioner herself. Those are two meetings, and we are required to discharge those. For the rest of the period now, we have six meetings in total. I think I talked to Mr. Tilson about this earlier, that there were another four meetings in which we would hear witnesses. That would bring us, hopefully, to the end of the witness phase.

Then, during the summer break, the plan I had discussed with our research assistants and the clerk was that we would then provide a summary of the proposed band-aid solutions for consideration, a summary of the evidence on each of those items by the witnesses, and any other items that came up and were suggested, by whom, and the argument there. So you would basically have that summary of evidence document, which would be distributed to us and available to us so that when we return from the summer break we will be in a position to start to assess and discuss those.

When we started the commissioner provided us with a list of witnesses, which in the first instance were to review the entire act. This a much broader list; there's quite a large number of them. Most of them were before the committee with regard to its PIPEDA review.

Our researcher had also provided us with a list of witnesses, not on the band-aid approach, but rather on the full review. Some of these we have, in fact, heard. We have also received from Mr. Hiebert a list of another dozen or so witnesses for consideration. I have no more witnesses other than the ones that have now been submitted by Mr. Hiebert. I don't think we're going to be able to accommodate them all in the four meetings.

It's nice to have a list of the possibilities here, but I think we have to have a little bit of an assessment of where the gaps are that we need to fill in: the other side of the story; new items; new input; and where can we get this thing rounded off and have a good balance of argument, not only on the band-aid issues, but also on any other suggestions that people may have.

I'm going to seek some assistance from Mr. Hiebert or the Conservative members on prioritizing or rationalizing if we are going to fill the four meetings with people from this list--the approach. If we want to deal with them all we can have panels. That will reduce their time, but in fairness to witnesses coming in we want to be sure they have ample time to do their work. Some may be better.

That is the game plan. Then when we come back we can review all the recommendations and the input from the various witnesses. We can then do our diligence in making a critical assessment of which items we feel are most appropriate and why; which ones at this time should be stayed or tabled for future consideration, for whatever reasons; which ones will start to give us the skeleton we need to do a report. That is where I'm looking right now.

I'd like to hear from Mr. Tilson, Mr. Wallace, and Mr. Van Kesteren.

[David Tilson, Conservative, Dufferin—Caledon, ON]

That pretty well covers it.

[The Chair, Liberal, Paul Szabo]

What do you think, Mike?

[Mike Allen, Conservative, Tobique—Mactaquac, NB]

Mr. Chair, I'll pass.

[David Tilson, Conservative, Dufferin—Caledon, ON]

You've pretty well covered the issues I was interested in. I'm not privy to the different list you have, and I question whether or not the subcommittee or the overall committee should be privy to that. So far, with the exception of the police officer, everybody has pretty well agreed generally with the commissioner's recommendations.

Someone out there must have some opposing opinions. Everybody has opposing opinions on everything. Without looking at the overall list, I don't know who that would be. I'm interested in the possibility--maybe the clerk and Ms. Holmes can make some comments--of having groups, as opposed to one person. We have two hours in a day, so you could have groups for either the full two hours, or two different groups, depending on who they are.

One of my observations is that several witnesses have come here, with due respect, who didn't seem to be prepared. They didn't seem to know why they were here. They had no comments about anything. They said “Here we are. Fire away with questions.” That's okay, but normally people come with some observations. They've looked at the recommendations. I'm just throwing that out to the clerk for the future. Maybe they were briefed--or maybe they weren't--but I hope in the future, groups will come and tell us what they agree with, what they don't agree with, and give us their own observations. If they had something in writing it might be useful for committee members as well.

So my observation is that several witnesses--not all--came here unprepared. I'm sure the group here today will be very well prepared, absolutely.

I don't know who's on your list, but one name I have is Dr. Ann Cavoukian, the Information and Privacy Commissioner of Ontario. I know she's respected across the country as a privacy and information commissioner. If she's on your list and coming, that's fine; if she isn't, I hope we will consider her.

There's a group that Madam Lavallée might remember. I don't remember what it was called. It was a newspaper guild. Does anyone remember them? They were mainly an information group, but they might have some observations on privacy. They represented the newspaper people across the country.

Those are the only names, and they may well be on your list. I doubt if the newspaper people are, but hopefully Dr. Cavoukian is.

[The Chair, Liberal, Paul Szabo]

The commissioner's list to us was circulated to the members. It came in a package to us. They are experts, most of whom were involved in PIPEDA as well, but there were some others.

The second list was from the researchers. It was also circulated to all members on April 4, and included provincial privacy commissioners for B.C., Saskatchewan, Quebec, Ontario, and New Brunswick as possibilities, because you don't know about availabilities. There were 17 there, plus we have 14 here. I haven't checked to see whether there's any duplication here.

The important thing for us to do--and I want to hear from the other members--is to try to fill in where we feel it's necessary. I don't think I want to have everybody, just because they're on a list. Members should make recommendations based on need and propose them to the committee. We want to use that time wisely. I don't know the people, where they might be able to fit in, and some of the other concerns. Maybe we'll hear that from the other members.

Let's hear from Mr. Wallace, and then Mr. Van Kesteren.

[Mike Wallace, Conservative, Burlington, ON]

Thank you, Mr. Chair.

Likely, most of the names you got from our parliamentary secretary came from me. I don't mind having them lumped together on a panel. I do take a little bit of exception. The Privacy Commissioner provided us a list of quick fixes, but we haven't looked at this for 25 years, as parliamentarians. I think we thought it was sort of an easy way to look at these ones first. It doesn't preclude us from looking at deeper things.

My thinking was that most of these fixes are for government agencies and government organizations that relate to the Privacy Act and are not necessarily third parties. But there are a number of third parties that deal with government that I'd like to hear from. For example, I had on the list the Canadian Association of Chiefs of Police; the RCMP, which we had heard from; and the Canadian Resource Centre for Victims of Crime. Those are the kinds of things.... I'm not sure what government information they have and whether the Privacy Act would affect their ability to do their work, or help them do their work.

There are two other areas I'm interested in. We have a heavily regulated banking industry in this country. Maybe that's coming from my finance committee. I'm not sure. We could hear from anyone in the banking insurance area--there doesn't have to be one meeting for each--to make sure that I have an understanding of whether what we're doing here for privacy has any effect on that industry and the private sector. It could be a panel group. Unless we invite them, we don't know whether they'll even come or not. Right? They could say “Look, it doesn't affect us, and we're not interested”, which is fair.

I had a few others, but the other group I'm particularly interested in is the Canadian Medical Association on medical records and anything to do with personal information that has to do with people's.... Hospitals aren't private sector and they're not public sector. The medical field is a little quasi.... I'm not sure exactly how you'd phrase that.

Those are the three areas, Mr. Chair, I'd be interested in. I may not have all the answers in terms of who those guests might be. Other lists may produce other, better guests, but the medical area, the banking and financial institutions area, and the crime and criminal side are the three I think we should try to see before we make any decisions.

And of course we haven't debated this as a group. We may agree or disagree with the quick-fix recommendations, as she calls them, or we may say this is obviously a bigger project than we thought, and we do need to take more time to do it properly. I just put that out for the record.

Thank you.

[The Chair, Liberal, Paul Szabo]

Okay.

Mr. Van Kesteren.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you, Mr. Chair.

The group I want to specifically speak to would be the prison guards, correctional services.

I find that most of the recommendations are sound. I think we've had some good witnesses who have presented their cases. But I'm concerned about some of the flaws in the system now. And although we can improve on this act--and as Mr. Flaherty pointed out last week, there definitely is some room for improvement--there is also room for improvement of some of the flaws. It appears that is a very serious flaw.

I would like to know, too--and I don't know if we've studied that or asked enough questions--whether or not there are other flaws in the system. But that seems to be a glaring error, or there has to be something there so we avoid having this happen if we make amendments to the act. I want to know what, first of all, is going on. I really want to uncover that. We probably could devote one of the meetings just to the correctional services.

The other thing--and I mentioned his name too, and no disrespect to any of the witnesses--is that Mr. Flaherty was a wealth of information. And I wouldn't mind, once we compile this thing, if we want to look at him one more time. I don't know if we were finished. That particular day we went right to 5:30, and I think most of us had two hours of bombardment. That was the day you left. He pretty much socked it to us for two hours. There was mental fatigue, I think, more than anything else. And Mr. Tilson was the chair at the time and it was like, “Okay, we've heard enough for a while”, but I'm not sure if we heard everything we want to hear from Mr. Flaherty. I think his presentation was excellent. So those are the two I would suggest.

Most definitely we have to get to the bottom of the problem we're experiencing in the correctional services.

[The Chair, Liberal, Paul Szabo]

I don't disagree with you.

Madame Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

First, I want to apologize to our guest, Mr. Comeau, for making him wait, but we absolutely have to establish the procedure.

Mr. Chairman, I didn't bring the first list that you distributed to us with me, but I have never seen the second one. So if we want to have a discussion that is in the slightest way informed, it seems to me that, if we obtained both those documents immediately, perhaps we could set aside 20 minutes or so at the end of the meeting to discuss future witnesses.

If I understand correctly, the purpose is to have guests who will provide us with diverse evidence, not to hear two or three witnesses who will talk to us about the same concerns. Nor should we lose sight of the fact that our goal is to finish before the end of June, even if it means extending our hours or summoning groups. The idea would be to finish before June and to have the best witnesses from both lists.

[The Chair, Liberal, Paul Szabo]

Okay.

Mr. Hubbard.

[Charles Hubbard, Liberal, Miramichi, NB]

I'm a little bit concerned, because we have a witness here who's been waiting 20 minutes. In all fairness, I think we probably should proceed with our witness.

[The Chair, Liberal, Paul Szabo]

I agree. I just wanted to be sure, because we need to have some clarity here.

I've taken note of the input and that some of it really concerns PIPEDA more than the Privacy Act, but I think we have some direction. We're going to make some contacts. I think we've had some good input from members and nothing is going to preclude the committee from adding further witnesses to the extent they're needed to do the job properly. There's no time limit or deadline for this project, but we do want to make each and every meeting a constructive one that will add to our knowledge. So that will be our objective. I've taken the input from the members, and we will do our very best to make sure that we have good quality witnesses before you.

The Minister of Justice and the officials are coming the week of the 27th, so these witnesseswill not appear until June. We'll come back to you when we return, just to update you on what we've found available and have booked tentatively—to make sure everybody's comfortable.

Is that all right? Terrific.

Mr. Comeau, I'm sorry.

We're going to split the time equally between you and our subsequent witness. I want to be sure that you get all of the time you need. I thought this was also important for you to hear, because we have a little bit of experience with some witnesses who have tended to try to cover the whole Privacy Act with a general approach. At this point, I think we understand that we cannot do a full or comprehensive review of the Privacy Act. But the commissioner felt that it would be helpful if certain urgent matters that required remediation were considered, either a so-called band-aid solution or a quick fix to hold us over until the appropriate time could be dedicated to doing a full review of the Privacy Act—which, as you know, has gone 25 years without changes. Obviously, there's a great deal to do.

I'm not sure, but have you seen the list from the commissioner? You have. So you're generally familiar with the ballpark.

You have also provided us with your opening comments. Don't feel obligated to read all of them to us if you don't want to. If you want to just focus or target or highlight some points, that would be fine, or whatever you wish. But I'm going to invite you now to make your opening comments to the committee. The best and most productive part of the meeting, though, is the questions and the comments, so we want to move to those as quickly as we can.

Thank you. Please proceed.

[Paul-André Comeau, Director, Laboratoire d'étude sur les politiques publiques et la mondialisation (ÉNAP), As an Individual]

Mr. Chairman, ladies and gentlemen members, thank you for your invitation. I am pleased to be here with you. For 10 years, I was used to appearing before the committees of the National Assembly. I've only been here once; so it's with some apprehension that I've come back. I won't read all my remarks, but I would simply like to make a twofold admission at the outset: I am a member of the Privacy Commissioner's external advisory committee, and I also wrote a study for the Commissioner on oversight agencies in the countries of La Francophonie. So I would like to avoid any idea of conflict of interest.

I would also like to say that I am not a theoretician. I will be addressing your topic from the viewpoint of a practitioner, which is what I was for 10 years during my term as chair of Quebec's access to information commission, which is concerned with both access to information and privacy.

I would like to draw your attention to three aspects, which are moreover quite directly related to the 10 proposals submitted by Commissioner Stoddart. The first is the reaffirmation of the fact that, with respect to your work, this is a study of a fundamental right, a right that is reaffirmed by the Constitution, or virtually so, by members of Parliament, the Supreme Court and doctrine on the subject. The consequence is very clear: with respect to a fundamental right, there cannot be two standards, one for the private sector, the other for the public sector. Citizens are entitled to the same respect for that fundamental right, regardless of which side of the fence they are on. That is why I have a practical suggestion to make on the subject, which is that you cheat the classic ombudsman model and, in certain areas, confer decision-making powers, concrete powers on the Commissioner to meet needs and to join the universal trend in this matter. If you have any questions on that, I can answer them.

My second point is the exemplary role that government must play in the implementation and respect of a fundamental right. In my view, it's unthinkable that government shouldn't have the same obligations and not be subject to the same restrictions as the private sector. And yet that's currently the case, when you take a close look at the two statutes, that concerning the private sector and the other concerning the public sector. In that sense, I think some of the Commissioner's recommendations are entirely consistent with this rebalancing of the two acts governing the same right.

Third, I would also like to encourage you to take a look ahead of or outside the problem that has brought us here today. Very simply put, the work, research and solutions in the privacy field are now being developed in large part in Europe, not the United States. The United States had the lead in this field. They innovated. They launched the Privacy Act, which was used as a model around the world, but they are now distinctly lagging behind and out of sync with a certain number of countries.

I would suggest that the Canadian government take advantage of its ties with the European Union to ensure that the Privacy Commissioner is, in one way or another, associated with the work of what's called in the language of Brussels the Article 29 Working Party, which consists of all the European commissioners in the field and which is the centre of research, innovation and especially dialogue with the United States. The Europeans have problems with the United States regarding personal information transactions and have structured a dialogue that I think could be helpful to us and wouldn't result in Canada being isolated in its dialogue with the United States. There will be a Canada-European Union summit in Quebec City in October. I think that could be an item on the agenda: how to involve the Commissioner in the business of that group? This is currently the fundamental international group in the area of privacy, especially, in the consideration of the impact of new technologies and inventions being deployed virtually everywhere which may constitute a threat to privacy.

Those are the three points I would like to raise. I think I've summarized them clearly. In any case, my brief is here, if you wish to use it.

I am ready to dialogue with you and to answer your questions at your convenience.

[The Chair, Liberal, Paul Szabo]

Thank you.

We'll start with Mr. Pearson.

[Glen Pearson, Liberal, London North Centre, ON]

Thank you, Mr. Chair.

Welcome, Mr. Comeau. I'm glad you're here.

You mentioned the obvious discrepancy between privacy in the private sector and privacy in the public sector. Those of us who worked on PIPEDA a year ago definitely get that; we understand the difficulties there.

But when it comes to certain public sector practices, we've had witnesses here—for instance, from the RCMP, or the Treasury Board—who think the act, as it exists, is fine. It could be retooled a bit, but basically it's okay to them. So when I asked them specifically, why is it that you would fight against legislative changes to this act, and I gave them something of an answer—is it because you're looking for more flexibility in the things you do—they said yes.

I would like you to comment what you think are the reasons for the Treasury Board or the RCMP or others in the public sector having problems with changing this. Why are they hesitant about this change that the Privacy Commissioner has recommended?

[Paul-André Comeau]

You'll allow me to draw on my previous experience in the field. I think that public servants, government administrators, are the same everywhere, regardless of the type of government. An act such as this is clearly not a very pleasant thing that makes life easier. It confers rights solely on citizens, and it imposes obligations on them. That's already discouraging, especially when a framework is provided for those rights. I think you nevertheless have to be very realistic.

The Treasury Board Secretariat has already developed this entire technique and these privacy assessment forms, which are part of the directives. I would be very surprised to see those directives applied uniformly across government as a whole. If the privacy assessment becomes an obligation under the act, I think that avoids abuses and errors as well. When an administrative reform is launched, when you need personal information to administer that project, what do you do? You always go after computer engineers who have all the right answers in the world with regard to security, but, nine times out of 10, have no idea what privacy may be. That, at the outset, is where the problems start, and then it becomes extremely difficult to make corrections. When you've realized that there was a problem, it's extremely hard and costly to go back.

I'll give you an example of a Quebec company that, to make its computer system compliant with the Privacy Act, had to spend more money on the upgrade than the initial cost to build the system. You'll say that happened a few years ago.

The guides published by the Treasury Board Secretariat are extremely well done. I don't see why organizations like the Royal Canadian Mounted Police, CSIS and others wouldn't submit to that. It's something prudent and prevents abuses. That directive exists. I think that making it an act is a wise move.

[Glen Pearson, Liberal, London North Centre, ON]

Thank you. That's helpful.

One of the other things that the commissioner asked for, as you know, is order-making powers. She felt it was essential to the work she had to do. She said she felt that she lacked the teeth necessary to make the kinds of changes that are necessary.

In her statement to this committee she said she wanted to be able to triage complaints and that there had been a backlog because some were somewhat frivolous. In order for what she wants to do to be successful, and from your own knowledge of the provincial jurisdictions, do you think the kind of triaging she wants to do would require order-making powers, or could she do it without order-making powers?

[Paul-André Comeau]

It must be said that triage is an objective specific to all jurisdictions responsible for privacy. It's universal and fundamental problem, regardless of the options, the models: an ombudsman, administrative tribunal and so on. So how do you resolve that? How do you deal with frivolous requests and those from people who are characterized as “quarrelsome”, that is to say people who file applications with various tribunals and agencies in order to block the system? It's not an easy question, especially since we're talking about a fundamental right here. You must not deny the rights of some for the benefit of others.

So there's a basic problem. My solution, although very limited, would be to give the Commissioner the power to require that the processing of certain applications be expedited. That would be particularly the case where it's realized at first glance that the application is unnecessary, deals with a matter that has previously been decided or is simply designed to cause delays in the process as a whole. The Commissioner could have the power to decide, even if it meant delegating that power to an associate. In my opinion, if the Commissioner's decision raised major problems, it would have to be possible to appeal it to the Federal Court or an organization of that kind.

Last year, I studied seven organizations from a number of regions of the world and I saw that it was the same everywhere. They're dealing with backlogs resulting from an increase in the number of actions by a small number of individuals. So there's no miracle solution.

[The Chair, Liberal, Paul Szabo]

Go ahead, Madame Lavallée.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

Mr. Comeau, as you observed, each of us has only seven minutes to ask you all the questions we want to ask.

[Paul-André Comeau]

So you want me to answer briefly?

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

If that's possible.

Everything you say is really interesting. I know you're very familiar with this issue. You are an expert in the matter. That moreover is why we invited you.

The Commissioner made 10 recommendations that you've no doubt examined. Are you in favour of all those recommendations?

[Paul-André Comeau]

Yes, except—