Information & Ethics Committee on May 11th, 2009

[Jennifer Stoddart]

These changes would not address the issue of Google Street View because Google Street View is covered by the other law, so we are applying that other law to it. It is, shall we say, a challenge for the moment. The challenge isn't so much the law as it is the relative novelty of the kind of collection of personal information that's suggested by Google Street View, but I understand you're going to have hearings and so on.

Let me say that there are other recommendations. Initially, we had a long paper of some 50 pages that we submitted to this committee, and we've since been trying to refine our suggestions.

I and the assistant commissioners would be extremely happy if you were to adopt these 12 recommendations. That would be a quick fix. More than that wouldn't be a quick fix, but a major reform. We're trying to be practical: we're trying to suggest things that are already in practice, things that are low in cost, and things that simply underscore existing Treasury Board directives.

Of course, if you want to go on, we can, but we would be very happy if you accepted these suggestions.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

Thank you.

With respect to recommendation eight, which is to strengthen the annual reporting requirements to cover a broader spectrum of privacy-related activities, can you outline the activities that broader spectrum would include and perhaps why you're recommending their inclusion? In other words, what are we missing that we should be including?

[Jennifer Stoddart]

Over the years we've found that reporting on Privacy Act compliance is either absent or perfunctory, so we would like to change this from a directive to a part of the Privacy Act.

We'd also like some stipulation as to what they would be reporting on. Examples might be privacy impact assessments, initiatives that might have an impact on personal information, or information-sharing agreements with other government departments and agencies, other provinces, or other jurisdictions in Canada. These are examples of data-matching or data-sharing.

All these things go on, and it's very hard to trace exactly how they're happening. The reporting is rather obscure or non-existent. This would make what's happening with their personal information more transparent for Parliament and for Canadians.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

This is my final question.

In earlier questioning, you made reference to the fact that the act is from 1982. I agree that major revisions are probably required, but you did touch on the fact that there are currently a number of exemptions under the act. Can you give me a few examples of the exemptions in the current act that we perhaps should have included in any new legislation?

[Jennifer Stoddart]

We haven't suggested changing the exemptions.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

I'm just curious to know what they are. I don't specifically know.

[Jennifer Stoddart]

I'll ask Hedy Kirkby to talk about the exemptions. There are a whole series of them.

[Hedy Kirkby]

The focus of the materials we've presented to the committee is more on the privacy protection side than it is on access to information, which is the corollary right to privacy. The Privacy Act contains both rights.

With respect to access to information, the only specific recommendation we made was that the right of access should be extended beyond the status quo, which is limited to persons present in Canada. That's becoming increasingly difficult to defend, given the international trends to make the right universal.

We don't go into the specific exemptions in any particular detail because, on the whole, the exemptions work quite well. The exemptions in the Privacy Act very closely mirror the exemptions you'll find in the Access to Information Act, and since that's the primary focus of the Access to Information Act, that's where you hear the Information Commissioner focusing their recommendations for change.

[The Chair, Liberal, Paul Szabo]

We'll have to leave it there. Maybe we can come back to that.

Go ahead, Mrs. Block, please.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

Thank you very much, Mr. Chair.

Welcome, Ms. Stoddart and colleagues.

I'm interested in going back to recommendation four and following up on Ms. Simson's questions. You stated that the public education mandate is not spelled out, and that if it were, quite possibly there would be an ability to allot certain resources towards public education. Could you describe to the committee what you intend by proposing a public education mandate, what components you would include in that public education mandate, and what the costs of such a program might be?

[Jennifer Stoddart]

First, honourable member, we haven't costed it because we're crossing our fingers that it will be recommended by this committee, and then, of course, we would cost it. If committee members wish, we could supply you with the amount of our public education budget for PIPEDA to give you an idea. Now, these are organizations across Canada, so it might not be exactly the same.

I mentioned funding research across the country in universities, small business, and citizens' organizations, and providing information to what in PIPEDA are called interested stakeholders. These are organizations that use PIPEDA and need help in its interpretation. If you translate that into the Privacy Act, these could be campaigns with national security organizations to clarify the problems they would have in applying the Privacy Act and to see how we could work better with them. It could be working with citizens who ask what their rights are now that our frontiers are becoming increasingly problematic in terms of privacy rights, or perhaps working with the Canada Border Services Agency.

All of this takes a certain amount of investment in media communications to get more up-to-date information brought out more quickly, and particularly to get young people interested in issues of privacy as they relate to government use of their personal information.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

In the world where I come from, it would be interesting to consider that we would make the recommendation without knowing what the costs could be.

[Jennifer Stoddart]

If the committee asked us for the cost, we could certainly give you some information on that very soon.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

When we speak to the fact of an education mandate, the power is already implied. Do you feel that you couldn't achieve the same benefit without a legislative change?

[Jennifer Stoddart]

My colleague the assistant commissioner thinks that perhaps the reason for the discrepancy in the notes is that it was a spokesperson from the ministry of justice who said the power was implied.

It's one of these difficult questions. You think you should be informing the public in a more timely, up-to-date, modern way, but your act doesn't specifically say it. Honestly, I'm a bit torn between what I should be doing and not straying beyond the bounds of my mandate. The fact is I don't have particular financing for it. I think I should inform Canadians of challenges with their personal information--for example, the RCMP exempt banks--but the audit took money, the special report to Parliament took money, and so on. That's an example.

It would be to enhance the kind of public education activities that I already do under PIPEDA, but on the side that involves the personal information that Canadians give to the federal government.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

Thank you.

Do I have any more time?

[The Chair, Liberal, Paul Szabo]

Yes, you do. You have two more minutes.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

I would like to look at your fifth recommendation. It would provide greater discretion for the Office of the Privacy Commissioner of Canada to report publicly on the privacy management practices of government institutions. As I read it, I thought that too might be part of a public education mandate.

How frequently would you like to issue these reports?

[Jennifer Stoddart]

I think the example of the Auditor General is very useful.

My understanding is that she goes four times a year. That would certainly give us more immediacy than once a year, because it ends up being a year and a half after things have happened. In this day and age, and especially to an electronic generation, you lose credibility about the message if you're reporting on it a year and a half later. People are living their news instantaneously now, so I'm concerned about shortening the time span between when things are happening and when, to be faithful to my mandate, I inform the public about them.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

What additional resources do you think you'd require to complete these reports? Are you already doing them? Do you already have sole responsibility?

[Jennifer Stoddart]

No, we don't. We've done two special reports to Parliament, both on the public sector. That's within my present mandate.

If we speeded up the reporting cycle, that would take additional resources. My office is very small, so when we're talking about additional resources we're talking about two or three people, things like that. We're not talking about large amounts of resources because we operate on a fairly small scale anyway.

[The Chair, Liberal, Paul Szabo]

Thank you.

Monsieur Nadeau.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you, Mr. Chair.

Good afternoon, ladies.

Recommendation 11 reads as follows: “Introduce a provision for proper security safeguards requiring the protection of personal information“. Does that mean that we do not have them at the moment?

[Jennifer Stoddart]

Actually, that is another of those curious circumstances. There is a Treasury Board directive on security and the protection of personal information. But in my experience and that of my predecessors, a Treasury Board directive does not seem to get the attention it requires from the department, certainly much less so than if were in an act. I do not wish to imply that there are no security safeguards. The government is presently developing a cyber security policy, and that is very important. I am very pleased that they are moving forward, but we are talking about day-to-day administrators of the act. I think that Parliament sends a much stronger message if it puts some minimum requirements into legislation, if it enshrines in legislation the basics of what needs to be done. We feel that these 12 recommendations make up those basics.

Subsequent interpretation and details can then be put into Treasury Board policies. However, since there has been no reform for a very long time, the basics are now to be found in the directives. A directive is just a directive, and the consequences are much less weighty than those in an act.

[Richard Nadeau, Bloc, Gatineau, QC]

Do you feel, as we do, that an act designed to correct the present situation would be perfectly appropriate and that the government should respond to the request for one?