Information & Ethics Committee on May 15th, 2008

[Prof. Michael Geist]

I think we do have a sense of where we are moving from a technological perspective--at least how it's going to impact privacy. There is broad agreement on the fact that there is a scope for greater collection, greater use. Some of that is very good, but there are some potential negative consequences. I wouldn't say I'm convinced there is a necessity to try to update a law with a specific technology in mind. If we take a look at some other areas where there have been attempts to do that, we invariably find that we either guess wrong or render the statute, at some time, out of date yet again, because the technology itself has moved much quicker than the law possibly can.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

I'd like to go back to the recommendations you made. I took note of them. You talk about the Commissioner's 10 recommendations in the same order, but it seems to me you're generally quite in agreement with all those recommendations. Is that correct?

[Prof. Michael Geist]

There are a few I didn't highlight because I don't feel I'm in as good a position to make that kind of recommendation. You were talking with a witness earlier about the discontinuance of complaints. I have some concerns about that in the context of PIPEDA. I have similar concerns about it in the context here, knowing that for many individual Canadians this is effectively the only form of recourse. Unless we have some very clearly articulated standards we run the risk of having someone who feels their complaint is legitimate, someone on the other side reaching a different conclusion, and the first individual leaving themselves with effectively no real recourse.

[Carole Lavallée, Bloc, Saint-Bruno—Saint-Hubert, QC]

You spoke briefly about the order-making power that you would grant the Commissioner. Can you tell us more about that?

[Prof. Michael Geist]

As I mentioned, I focused on that, both at PIPEDA and here as well. From my perspective, the Privacy Commissioner plays a critically important role in ensuring adequate enforcement, from both private sector and public sector perspectives. On the private sector side, issuing nothing more than non-binding findings isn't good enough, and I think order-making power would be more valuable.

In the context of the Privacy Act, I must admit that the power of moral suasion that the commissioner might well have might well be more effective with a government department than it would be with a private sector entity. I think both from a consistency perspective and for those instances in which you effectively have a standoff between a department on the one hand and a privacy commissioner on the other, order-making power might well prove valuable.

[The Chair, Liberal, Paul Szabo]

Mr. Van Kesteren, please.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Thank you for appearing here.

I want to continue on, just quickly. I was going to pursue the line of questioning on order-making power. We talked about teeth. How many teeth should the order-making power have?

[Prof. Michael Geist]

I think the prospect of fines and the like may have some impact, but I think a conduct-based order-making power is more essential. Both in a private sector and in a public sector environment, it's the ability to compel certain kinds of action.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Are you not afraid that we're opening Pandora's box when we give order-making powers, if we say this doesn't work so now we're going to expand that? Is that not just a slippery slope?

[Prof. Michael Geist]

The Privacy Commissioner has already told you she doesn't want it--

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I'm not worried about this one.

[Prof. Michael Geist]

--so if she gets it, my guess is that there'd be something of a reticence to use it. I think that any person in that position, regardless of who the particular commissioner happens to be, would recognize that ordering another government department to act in a certain way is the sort of thing you would do only in the most extreme of circumstances.

Indeed, if we can imbue within our federal government that notion of a privacy culture, one that is consistent with the act, one would hope that you'd never need to actually resort to the order-making power. But the fact that it is there I think would perhaps help move some of those cases along.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

Mr. Chair, I'm going to be splitting my time. I do have another question, but I'll split my time with Mr. Wallace.

I missed the intellectual property caucus last night. I had a previous engagement with the industry committee. You're probably most knowledgeable in that area. Is there not somewhat of a.... I guess I'm trying to understand your position. I'm not disagreeing or agreeing with it. I don't want to do that. I'm trying to understand your position on IP.

When somebody owns the rights to a game and sells it, then we suddenly take possession of that. Isn't that their personal property? I'm trying to find out how you marry this with whatever information that institution has. Isn't there a little bit of a disconnect there?

[Prof. Michael Geist]

I don't think so. I didn't think we'd be talking copyright, although I'd be happy to do so. I got into a lengthy debate with your colleague Gord Brown, talking about some of those specific issues.

I actually think there is a consistency, both with the concern for appropriate protections of privacy and with concerns about where copyright legislation may go. A good example of that is the prospect that some technologies--to come back to the question about different kinds of technologies--can be used not only to lock down certain kinds of content but also to extract personal information without the knowledge of a particular individual.

We've had that in one case, the Sony rootkit case, in which hundreds of thousands of Canadians found themselves subject to both a security breach and fears that their personal information would be sucked out and sent, essentially, to the mother ship without their knowledge. One of the concerns is that to effectively provide appropriate protection, you have to provide someone with the ability to circumvent, to ensure that they can indeed protect their personal information.

So when I come before you to argue about the essential need for a strong privacy culture, both within the Privacy Act as well as, frankly, within PIPEDA, I think that's wholly consistent with calling for a copyright act that reflects a fair balance between the interests of users and creators.

I'd be happy to talk about that offline.

[Dave Van Kesteren, Conservative, Chatham-Kent—Essex, ON]

I don't want to use all my time. Mr. Wallace is going to share.

[Mike Wallace, Conservative, Burlington, ON]

I have two quick questions about consistency. This may not go right to the act, but I'd like your opinion on this.

The government, through the Auditor General, notes that 64,000 people have been identified to leave the country, and we have no idea where 42,000 of them are. Some of them have been in my office. Some of them are working, so they need to have SIN numbers. CRA knows who they are and where they're working, but our border security may not know where they are. Do we have the right, from a privacy perspective, to pass information on from one organization to another within government?

[Prof. Michael Geist]

I think it's a question better posed to the Privacy Commissioner, who would ultimately be able--

[Mike Wallace, Conservative, Burlington, ON]

Chicken. What's your answer? I want an academic opinion on this.

[Prof. Michael Geist]

Chicken? With respect, I try to speak authoritatively on the issues I know well. To give you an opinion when there are people who are better situated to give you one isn't the best idea.

[Mike Wallace, Conservative, Burlington, ON]

I was hoping for an academic opinion on it, but that's okay.

You have mentioned that you are part of the press, part of the media--you've written for the media. The media has a role in privacy, which I don't disagree with. A source is private between them and the individual in the media. But I find it kind of ironic when I hear from the media that the government isn't as forthcoming as it should be with information, and some of it may have privacy issues attached to it.

Do we not have the same right to protect, as a government--I'm not saying us as a government, but government in general? Are we not being consistent? The media asks for more information, but they have the right to protect their source. Do we not have a responsibility as a government to protect the privacy of people, even though the media may want to know about the issue?

[Prof. Michael Geist]

Our access-to-information legislation has privacy protections when it comes to particular personal information, so there has already been an attempt to strike that balance. In many instances the media relies on sources, where people provide information at great personal risk, so I think it's logical that you'd provide a measure of protection for that. In the context of government, if you're a firm believer in an open, transparent, and accountable government, it must absolutely follow that openness is one of the priorities. The ability, not just of the media but of all Canadians, to access that is truly essential, whether it's through the access to information office or something like CAIRS, the database that I think has proven to be so useful to so many Canadians.

[Mike Wallace, Conservative, Burlington, ON]

So you think those private protections should lie in the ATI Act and not the Privacy Act, and you agree there should be protection of people's private information in the ATI Act.

[Prof. Michael Geist]

As someone who has been the subject of some ATI requests, absolutely. There are appropriate limits within ATI on that, but at the same time, even in those instances, the obligation falls to the individual to show that the information is subject to an exemption, or that the Privacy Act applies.

The paramount perspective is one of openness, transparency, and accountability within government. That's the right approach, and it's why I'm a big supporter of ATI and the CAIRS database.

[Mike Wallace, Conservative, Burlington, ON]

Thank you.

[The Chair, Liberal, Paul Szabo]

Mr. Pearson is next, followed by Mr. Tilson.