Evidence of meeting #38 for Access to Information, Privacy and Ethics in the 39th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.
A recording is available from Parliament.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
I believe notification was one of the ones the commissioner recommended. We added the general duty to protect personal information and the issue respecting data matching, if my recollection is correct.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
You may be right, but I can't find the recommendation dealing with notification.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
My apology; I believe it is included in the necessity one.
One moment.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
I for one have not seen it. It was not included in any of the 10 recommendations.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
I'm sorry; my apologies.
The first two, the duty to protect and the data matching, were considered separately, and they were considered to be at least connected to the reporting by the federal Privacy Commissioner.
Within the discussion we had at the Canadian Bar Association, because we weren't looking at a complete overhaul of the Privacy Act, we were looking to consider the issues we thought were the most significant and thought that if there were a limited amount of attention that could be given to the Privacy Act, we should focus on those. Breach notification is related to other issues that the commissioner brought up, but it's also seen as something that needs to be considered, and considered consistently as between the private sector and the public sector.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
So you would put that in as recommendation number 11.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
I don't have them numbered separately.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
The commissioner numbered them.
So you are making that recommendation in addition to the ones already presented. Some witnesses have made other recommendations. I would like your opinion on, among other things, the commissioner's quasi-judicial power to make orders.
The commissioner said that she did not need that power in order to do her work. But some witnesses have indicated that no one would take a commissioner seriously that did not have the power to make recommendations or act as an ombudsman.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
Without having turned our minds explicitly to the narrow question of whether the commissioner in this context should have order-making powers in the Privacy Act rather than PIPEDA, the consensus seems to be that in order for there to be proper accountability within the legislation, there needs to be a mechanism to make sure there's accountability for the statutory requirements set out within the Privacy Act to an external body, be it the court or the Privacy Commissioner.
The consensus we reached was that the Federal Court of Canada should have the ability, on the motion of an individual citizen or the Privacy Commissioner of Canada, to require a government department, crown corporation, or another public institution affected by the Privacy Act, to follow all of the requirements of the Privacy Act, not just the ones related to the access to personal information.
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
I am sorry, but I do not understand. You say that you have not looked at whether the commissioner herself should have order-making power. You also say that a body outside the commissioner's office should be able to require individuals, officials or federal institutions to comply with the act.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
I just want to make sure I fully understand your question.
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
There are a number of different models. There's the one that would give the commissioner the power to compel a public body to follow the requirements of the law. Currently it's not the court nor the Privacy Commissioner; it's simply a requirement that every citizen and every employee of the crown follow the law, but there's no particular accountability.
Without completely revisiting the role of the Privacy Commissioner of Canada--which is currently in the model of being an ombudsperson--the best way to do it, as an interim measure at least, is to give the court that power and leave the Privacy Commissioner of Canada within the ombudsperson sort of model it is.
On whether we think that giving the Privacy Commissioner order-making powers would significantly change the role of that office and the person in it, that debate should probably take place in a wider debate about more comprehensive reform of the legislation.
Bloc
Carole Lavallée Bloc Saint-Bruno—Saint-Hubert, QC
Thank you.
You talked earlier about notification regarding situations where there were potential violations or disclosure of personal information. If I remember correctly, the committee's recommendation was that businesses would be required to notify the commissioner in those types of situation under the Personal Information Protection and Electronic Documents Act. The commissioner would decide whether the people concerned would be notified. It might be good to add that possibility, after all.
Thank you.
NDP
Pat Martin NDP Winnipeg Centre, MB
Thank you, Mr. Chair.
Thank you to both of the witnesses. It's been very interesting.
I don't know if I fully understand Brian's comments that the Privacy Act should have the same duty of notification provisions as PIPEDA. One of the big flaws of PIPEDA is that it doesn't have the duty of notification, and when our committee studied it we recommended unanimously to the government that it should have duty of notification. But when the government reacted to our report, tabled in Parliament, they said clearly the government is not interested in putting duty of notification into PIPEDA. So I don't think we're any closer to having that duty put into statute at all, which is really worrisome to me, because a lot of Canadians would be horrified to know or would want to know if their personal information was compromised in the private sector or the public sector.
The PIPEDA report was just tabled in Parliament today by the Privacy Commissioner. You might want to get a copy of that. It talks about the TJX case, where personal information and 94 million debit card and credit card numbers were compromised in that one violation alone. There were 94 million--they weren't all Canadians--people from around the world, I guess. This is worrisome to me, and I think the Privacy Act should have a rigid duty of notification.
The cross-border sharing of information is of great concern to us. I want to thank you for bringing your input into this, and specifically citing the Maher Arar case as a graphic illustration of what can go wrong and has gone wrong.
Is there anything more you can tell us about the Canadian Bar Association's views on this? Or would you like to speak a little more on the subject of how we might prevent another Maher Arar incident?
Chair, National Criminal Justice Section, Canadian Bar Association
Certainly the CBA has taken positions in relation to this issue really since the anti-terrorism legislation was tabled. And we have appeared before different committees and we have expressed concern with respect to the need to have appropriate checks and balances in place.
We recognize it is very easy to speak in generalities such as that, to say that it is important to have the checks and balances. And it's equally easy to make remarks such as that it's important that there be effective law enforcement. What that actually looks like in terms of the drafting of a statute, for example, is very, very difficult. But one must start from first principles of agreement to ask, is it agreed that there should be a mechanism of accountability?
We have taken the position that it should be an independent body. So our position is that the RCMP, for example, should not be responsible for their own oversight on these types of issues. And because it is an independent body that is disinterested in an ongoing issue, that can perhaps most effectively ensure compliance or an accurate audit of what is actually going on.
What can be learned? Well, hopefully the specific incident of Mr. Arar...all of Canada must desperately hope that this will not be repeated.
Is there a mechanism in place to ensure that it will not be repeated? I'm not sure, because what is going on is there continues to be, as I understand the allowances of law, a vast amount of information gathering and information sharing between agencies within Canada and abroad. And until one knows exactly how much information is being gathered and what information is being gathered and why it is being gathered and who it's being shared with and whether that sharing mechanism has appropriate checks and balances, it's really impossible to know whether or not some of the mistakes of the past will be repeated.
NDP
Pat Martin NDP Winnipeg Centre, MB
That's very well put.
With what little time we have left, you've led me to another thought. This committee wrestled with section 7. Paragraph 7.1(e), I believe, of the national security legislation essentially gives the government the right to deputize others to intrude into a person's private information. One of the examples used was that a government couldn't open up a worker's locker without a warrant, but they could have the employer do it and pass that information along to them, if they have a third party do an end run around your rights to privacy through the national security legislation.
Do you know what section I'm getting at here?
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
Are you referring to paragraph 7(3)(c.1) of PIPEDA?
NDP
Pat Martin NDP Winnipeg Centre, MB
Yes, that's it exactly. It's somewhere in there. That's right. It was in the context of the long review of PIPEDA that we did. I guess the law association has made representation, perhaps, on that clause in the past, and you're aware of the point I'm raising. Would you care to expand on that?
Treasurer, National Privacy and Access Law Section, Canadian Bar Association
That particular provision is in PIPEDA, and much of the debate relates to some uncertainty regarding its interpretation. But ultimately, it allows the disclosure of personal information, without consent of the individual, to a law enforcement body or a national security body that has requested it, has identified its lawful authority to have it, and says that it's for the purposes of law enforcement or for enforcing a law.
Currently there's virtually no analogous restriction in the Privacy Act that we have before us. For example, the RCMP and Revenue Canada are both institutions of Her Majesty or the crown, which are indivisible; they're just organized in different sorts of ways. So information shared within one department or shared between two departments does not amount to a disclosure in the same way that under the private sector legislation it would be.
Under the current legislation, there is no necessity test or necessity requirement for that information. There's not even an obligation on the part of the law enforcement body to identify that it has the lawful authority to have that information, or even that it relates to a particular purpose.
It is my understanding that there are memoranda of understanding between government departments with respect to the sharing of that information, but those memoranda of understanding don't go through the checks and balances my colleague just referred to. They don't receive the same sort of scrutiny. The Privacy Act, as it's currently drafted, doesn't stand in the way of any of those sorts of practices.
Conservative
Russ Hiebert Conservative South Surrey—White Rock—Cloverdale, BC
Thank you, Mr. Chair.
A number of questions come to mind.
One thing that the Privacy Commissioner mentioned was that a lot of complaints--in fact, the single largest source of complaints--her office receives are from inmates in Canadian correctional services, and she felt that many of these were frivolous or vexatious.
While I'm sure there are certain complaints from inmates that are legitimate, it does seem strange that so many of them are coming from that area, a much higher number than from any other area.
Mr. DelBigio, since you have some background as a defence attorney, can you explain to the committee why there are so many complaints coming from this area? What are they used for? Why would this be the case?
Chair, National Criminal Justice Section, Canadian Bar Association
I can't comment either through my day job as a defence lawyer or in my capacity as a CBA member. I did read somewhere that this had been an issue before, that there had been evidence to this effect before this committee. And I'm sorry that I really couldn't give you an answer to the question beyond mere speculation.
