Information & Ethics Committee on May 11th, 2009

[Jennifer Stoddart]

Yes, that is a different question. There are costs when you go to Federal Court. There are costs, and the court is not available in all communities, only in some of Canada's largest cities. However, that does not come under the Privacy Act, so I have not commented on it.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Are we not running the risk of creating a kind of two-tier system? You would refuse to deal with people's complaints and then they have to spend money to get information from the court that they would not have to pay for if you did the investigation.

[Jennifer Stoddart]

What is your question?

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Would that not be a form of justice denied for people who...

[Jennifer Stoddart]

There is that risk, but the problem at the moment, in my opinion, is the lack of discretionary power. Our office must focus on complaints where we can really have an impact, where we can do some good, and free ourselves of complaints that are not so much questions of personal information as other problems masquerading as complaints.

I feel that, in one sense, we are not providing very good service to people with real problems at the moment, because we are required to deal with a huge array of problems. I think that Canadians as a whole would be better served if we could take a little more selective approach and focus on new problems that we are seeking a solution to. However, because any government organization can make mistakes, in all fairness, we have said that, if we refuse to take up a complaint, we recommend that people go to Federal Court if they think a wrong has been done. They can seek justice there, but it should only be a minimum of cases, those where we see that nothing can be done and we are best out of it.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

You also said that audits and investigations carried out by your office have shown that institutions are not consistently meeting their commitments under government policies and current standards.

At the beginning of your presentation, you mentioned changes that could be made quickly. However, you did not list them. Could you provide a list of these quick-fix changes? Can you tell us how you propose to make institutions meet their commitments and your expectations?

[Jennifer Stoddart]

I think that the key is in recommendations 8 and 12 on the list. This would enhance the status of what, at the moment, are only Treasury Board directives. Within state apparatus, much more importance is given to the provisions of an act than to the contents of a directive that, at times, is inconsistently applied. For example, we do not always have privacy impact assessments. We are recommending that you include them in the amendments to the bill so that they receive the attention they deserve.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

Earlier, one of my colleagues asked you a question about requests from countries where human rights are not respected, countries with which we would perhaps prefer not to share information.

How do we ensure that this information is really protected from such requests? Would it be through your discretionary power? How do we detect these requests and how do we deal with them at the moment?

[Jennifer Stoddart]

We have to significantly reinforce the requirement in the current act for departments and agencies—we were talking about the RCMP just now—to be more careful and vigilant about putting things in writing. A matter of national security does not have to be made public. What is the information that we are going to share with such and such a country for such and such a purpose? What will be done with the information? We would have to make a comprehensive list of the countries and organizations with which we exchange personal information. Eventually, if the government establishes an oversight organization, that organization could make sure that the RCMP complies with the understandings, the exchange lists, the agreements.

[The Vice-Chair, NDP, Bill Siksay]

Mr. Dreeshen, for seven minutes, and then hopefully we'll come back to my spot if Mr. Szabo is back in the room.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much, Mr. Chair.

Ms. Stoddart, I want to welcome you back here to discuss privacy and ethics reforms. I personally thank you for your ongoing leadership in a time of increasing public concern for Canadians regarding privacy issues. You spoke of the new technology, the new ways of offering services, and the information superhighway. All of those things are important to us all.

As commissioner you've concluded that there could be some benefits if the Privacy Act and PIPEDA were more closely aligned. Other reforms seem to be inspired by provincial approaches to ATI and privacy legislation. These issues, whether it be the Privacy Act or PIPEDA, or provincial responsibilities versus federal responsibilities, should be reflected, I think, when we consider these Privacy Act reforms. Perhaps as you answer some of our questions you could keep those points in mind and reflect on them as well. I'd appreciate that.

Your first recommendation would create a legislative necessity test, which would require government institutions to demonstrate the need for the personal information they collect. Does section 4 of the Privacy Act not already include a necessity test for the collection of that personal information?

[Jennifer Stoddart]

I believe the current test is simply the consistent use once the information is gathered. I think it's very important for the Privacy Act to mirror not only PIPEDA but much provincial legislation, in that there's a test. You can't just collect anything and then say you'll collect anything. There's only a limit as long as it's used consistently.

There's an initial test: there has to be a reason for it, there has to be some kind of necessity. In the provinces, if you look at them generally, there's either necessity or law enforcement, which is a general...I. won't say it's an exemption, but it's a recognition of the particular role of public security forces like the police, or legislation. There's specific legislation the legislature has addressed its mind to and said the government will collect information for this. You have none of these specifics in the current Privacy Act, and in PIPEDA there's information that a reasonable person would consider justified in the circumstances for the purposes. So I'm contrasting both the provincial and PIPEDA to the general laissez-faire approach of the Privacy Act.

[Earl Dreeshen, Conservative, Red Deer, AB]

Would policy change rather than a statutory change be more appropriate to ensure the flexibility the minister recommended last year?

[Jennifer Stoddart]

I'll come back to my remarks about policy. We think, having observed for over 25 years, if you look at the series of annual reports done by me and previous privacy commissioners, the things that are merely put in policy are often not taken seriously enough. Perhaps it didn't have the consequences, let's say, in 1987 that it does now, but we think this is the time to elevate them into legislation. There are also extensive exemptions in the Privacy Act. There are quite a few exemptions, so I think they would also apply to a necessity test.

[Earl Dreeshen, Conservative, Red Deer, AB]

The minister had talked about a potential conflict between recommendation number two and recommendation number six. On one hand, you're broadening the application for court review, while on the other you're giving yourself broader discretion to refuse or discontinue complaints. Going that route would create greater grounds for appeals to the courts. As guardians of the public purse, we are concerned about these two recommendations, which are not only at odds with each other, but if they're implemented they could place an undue burden on the courts and the costs associated with these sorts of appeals. I was just wondering if you could comment on that.

[Jennifer Stoddart]

Yes. Perhaps I could direct the committee to look at the history of my office's experience under PIPEDA, where we have slightly more powers to deal in a more summary fashion than we do under the Privacy Act, and the relationship between those powers and the number of complainants going to the Federal Court. There are very few. I think right now, in terms of active complainants in the Federal Court where we're not involved, from memory we might have maybe five or six. These are people who go on to Federal Court. In recent years--I hope I'm not being inaccurate--I think almost all of them have lost or withdrawn their cases; the court did not find their cases had merit. I don't think that is a huge burden on the public purse. Of these six cases, let's say there are perhaps three now where we're active. Most of them are people going on their own, so there would be no cost via my office.

[Earl Dreeshen, Conservative, Red Deer, AB]

Going back to what Mr. Wrzesnewskyj said, you were talking about the RCMP and the number of complaints there. Of course, we look at the five main issues. I guess the five people had complaints that were well founded. Basically, you're saying your department doesn't consider over 90% of them to be well founded. I guess if you're looking at it from that point of view, would the RCMP be considering this as a majority of the complaints that come their way are not ones they would perhaps consider major?

[Jennifer Stoddart]

If I look at it as 52, I read only three are well founded, two are well founded and resolved, and all the others are resolved, settled, not well founded, or discontinued.

[Earl Dreeshen, Conservative, Red Deer, AB]

I guess I was just looking at whether it's all negative when you're trying to consider five out of 52. I'm not saying there aren't problems, but certainly sometimes it's perception in degree as to what some of the concerns might happen to be.

[Jennifer Stoddart]

Yes, but if I may say so, the possibility of going to Federal Court in our experience usually focuses both parties on seeking a settlement.

[Earl Dreeshen, Conservative, Red Deer, AB]

If I have enough time, I will just ask one more question. What do you think the cost implications would be of going to recommendation three, and which could not be achieved through policy change rather than a privacy impact assessment legislative scheme? I think you had spoken about that before.

[Jennifer Stoddart]

That's an interesting question, because under the directives there is supposed to be a privacy impact assessment for every program now. So theoretically the money is in the departments. So I don't see that a case has to be made.

Departments are supposed to follow directives to get any more money, because it's now in the act. What we've simply said is that somehow directives aren't followed, but the money should already be there to follow the directives. So I would think there would be no cost of implementing recommendation three.

[Earl Dreeshen, Conservative, Red Deer, AB]

And would it be the same for provincial agencies as well as federal agencies?

[Jennifer Stoddart]

This wouldn't affect provincial agencies; it would just be federal agencies. They're supposed to be doing this. I'm just making the point that they're not doing it; that's why I would like you to put it into law. But my understanding is that they've already been granted the resources to do this, because this is a directive they're supposed to be following.

[The Chair, Liberal, Paul Szabo]

The PIAs would certainly be helpful to the legislators as well, to understand the impact of changes to policy.

Mr. Siksay, please. And thank you for sitting in.