Information & Ethics Committee on May 11th, 2009

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

Thank you for being here again, Commissioner, with your colleagues.

I note that you've added two new recommendations this visit. I have this vision of seeing a list of 14 down the road, and then maybe 16. I hope it doesn't come to that, because I hope we can make some progress in moving on these ones before us.

I wonder if you could say a bit more about the new recommendations 11 and 12. I think we heard about number 11 in the context of a duty to protect, and I wonder if you could say a bit more about that. Then I think on recommendation 12, witnesses phrased it to us in terms of the duty to notify. I just wondered if you could say a bit more about those two.

[Jennifer Stoddart]

Yes, both of them are cases of what I was discussing with the previous honourable member; that is, they are in fact policies. Obviously the Government of Canada has a security policy and Treasury Board has breach notification guidelines. Again, we don't hear much about problems with data being lost or misused in the public sector, but we know there are some problems. We know them often from the media. Occasionally we'll hear something from the government itself. But again, there's a kind of momentum, as I was describing to you about going to Federal Court. If you put this into a law and you say there are breach notification guidelines and that they have to inform the privacy minister when there's a breach notification, I am hoping this will mean that these issues will be taken more seriously and that there will be fewer stolen laptops with citizens' information found under bridges, as we reported a couple of years ago.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

One of the other recommendations we heard was about order-making power for your office. I know it's not one that you've recognized, but I believe it's also something you're working on or are investigating further. Can you say a bit more about that?

[Jennifer Stoddart]

Ye. You will notice I haven't asked for order-making power, because that would not be a quick fix, to say the least. It would involve looking at the whole structure of my office. In fact, in the context of PIPEDA, I am commissioning work by some scholars to look at the things that weren't looked at when PIPEDA was brought in. Many people now say we should have order-making powers, and the Information Commissioner has asked for limited order-making powers. So I am commissioning a study that should be out this year. But again, that's not something that's already in a directive. If you look, we do most of these things already, or they've been suggested, for example, by the O'Connor inquiry, or they're not radically different.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

So it's not a quick fix, but it's something that is worth further consideration?

[Jennifer Stoddart]

It certainly is, and we're looking at that, yes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I wonder if you can take us through recommendation five again. Certainly I have had some questions about just what you were requesting there. Could you explain what your reporting powers are right now and how this would change as a result of this quick fix?

Right now you talk about having annual and special reporting provisions, but is this recommendation aimed at giving you the ability to report more often, for instance, and outside of that, and to be more like the Auditor General, who has the ability to report as often as necessary? Is that what you're talking about, and not having to wait until the end of the year? Could you just expand on exactly what you're looking for?

[Jennifer Stoddart]

It's exactly that kind of thing, to have specific reporting powers so we can keep up with the modern media.

Maybe Hedy Kirkby can explain the problems with the current Privacy Act.

[Hedy Kirkby, Legal Counsel, Office of the Privacy Commissioner of Canada]

I'll start by mentioning that under the private sector act, PIPEDA, there is a specific provision that enables the commissioner at any time, at her discretion, to disclose information concerning the privacy management practices of private sector organizations. When there is a matter the commissioner wishes to bring to public attention, she may do so. In so doing, the name of the complainant is never identified, but the name of the organization is.

A similar type of provision would be welcome in the Privacy Act, because currently it has nothing whatsoever other than provisions that speak specifically to annual reports and special reports to Parliament. It's unclear at best, legally, what the ambit of the commissioner's power is to go public upon completion of an investigation, for example, in which she would identify the government institution by name.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Right now, there's the ability to do an annual report and special report. How are special reports defined? What would they look like under the current regime?

[Hedy Kirkby]

We did a special report recently for the audit of the exempt banks of the RCMP. I believe we also did it for the joint audit that was conducted with the Auditor General more recently. On those two occasions, these were important issues that we felt should be brought to the Canadian public in a timely way.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

What would be different from a special report, in terms of what's being proposed now?

[Hedy Kirkby]

Those are large reports that have Parliament as their intended audience. They are presented to Parliament, as is an annual report. What is envisaged is that on a smaller, more periodic basis one could report in a more summary fashion on interesting developments and decisions made by our office.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Report to where or to whom?

[Hedy Kirkby]

It's to the Canadian public by putting information on our website. That's the way we do it currently for the private sector act. We simply put up a case summary.

[The Chair, Liberal, Paul Szabo]

Thank you.

I'd like to pursue that. I know the members were a little concerned about it going around Parliament. Let's deal with the question about how we respect your responsibilities to report directly to Parliament before the public. Are we anonymizing or de-identifying persons? Are we giving information out that may be interpreted as maybe being too specific, or are these generic or general developments based on case consideration?

[Jennifer Stoddart]

The intention certainly is not to go behind Parliament. The intention is to try to tailor the language of the 1983 Privacy Act to the way with which the public is used to being communicated to in 2009-10. How do you get a message about the protection of personal information to Canadians, particularly the younger generations now, if your primary vehicle is, for example, an annual report? By the time it's done and so on, it's 18 months after things have happened.

We would like to have a more flexible approach. For example, we could report to Parliament at much closer intervals. We could and do put some anonymized information on the website. We could perhaps make public some of our audits, so that Canadians know what to expect and have more transparency about the government's handling of their personal information. If you look at what we do in PIPEDA, you'll see an example of how we would like to deal with the Privacy Act.

[The Chair, Liberal, Paul Szabo]

Let's look at what the Auditor General does now. The Auditor General can report to Parliament as often as she wants, but the Auditor General also participates, as you do, in conferences, in speeches, in visitations, and in interviews, when asked, I assume.

Does what you're proposing go beyond what the Auditor General might do in terms of the safeguards she would have?

[Jennifer Stoddart]

No, we would never jeopardize the protection of personal information nor our relationship with Parliament.

If we could have the possibility of going to Parliament whenever we wanted to, if for example we had done some kind of audit that we thought you should know about, we could kind of turn it around a lot faster and lay it out before you specifically rather than waiting 18 months and saying it's a special report. It would have to be a very big audit to be a special report. So we need something in between.

[The Chair, Liberal, Paul Szabo]

All right. That's fair enough.

We'll go to Ms. Simson, please.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

Thank you, Mr. Chair, and thank you, Ms. Stoddart, for re-appearing before the committee. It's been an eye-opener.

I'd like to ask you about recommendation four, which is to provide your office with a clear public education mandate. That recommendation has been supported by a number of witnesses. However, it doesn't have the support of the Minister of Justice and his department. His position was that this power already is implied within the existing act.

I'm sort of looking at the wording. You want it clear, while he's talking about implied. What is it that you would like clarified in terms of making it a little sharper or crisper and having it enshrined in the legislation?

[Jennifer Stoddart]

That's interesting that you quote the Minister of Justice as saying that this power's already there, because in fact my office noted that the Minister of Justice used this recommendation as an example that some of the proposed changes we suggest may be possible. So I don't know. I think he appeared several times. That's more my reading of it.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

I was just looking at the summary we received. There were witnesses who supported your fixes and those who maybe objected or did not support your recommendation. It was strange.

[Jennifer Stoddart]

Yes, we come to slightly different conclusions, but I will answer your question.

The public education mandate is not specifically spelled out in the Privacy Act, again in contradistinction to PIPEDA, a much more modern law. As a consequence of that, I believe that we don't really have the resources for a public education campaign or public education activities in terms of informing Canadians about their privacy rights vis-à-vis the government.

We don't, for example, have specific allotted resources to do research on national security and privacy issues, as we do under PIPEDA, with its specific contributions program that was written right into the law. I distribute grants every year so that people can do research into the impact of PIPEDA on their privacy. I think that would be very useful in terms of developing public policy.

That's the difference. It would make a big difference in terms of what we can do with the broader public.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

That's great.

Mr. Siksay noted that you added two additional quick fixes. Are there any other immediate quick fixes you would recommend? Lately we've been reading a lot about Google Street View. There seems to be a huge concern about that particular program. Reading about it in the paper, it would appear that the concern of your office has a lot to do with the storing of the images.

When I read through your report, I really appreciated the fact that there is a great concern about the storage of information, which could impact the privacy of citizens. Would these quick fixes, if they were all adopted, cover off things like Street View, or is there something more specific we could be doing? It appears that there's a great deal of alarm on the part of the public, and this is also something you were taking extremely seriously, based on the media reports.