Information & Ethics Committee on May 25th, 2009

[Jennifer Stoddart]

No, it hasn't been contemplated in those numbers, because the numbers are based on our legal responsibilities and obligations now. We don't have a specific public education mandate for the Privacy Act, which was adopted in 1983. We give information on it, of course, minimal information, but we don't undertake these public education campaigns with outside partners, such as organizations or provinces, because we're not specifically funded for that.

If the government were to change the law, we would sit down with Treasury Board at that point, and there would be an estimate of the resources needed. I think it would come before the parliamentary panel for a recommendation as to what would be needed to fund it.

[Kelly Block, Conservative, Saskatoon—Rosetown—Biggar, SK]

Thank you.

[The Chair, Liberal, Paul Szabo]

Thank you very much.

Mr. Nadeau, the floor is yours.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you, Mr. Chair.

Good afternoon, Ms. Stoddart and Mr. Pulcine.

In recommendation four, you ask for a discretionary power that would allow you to decide whether a complaint is worth pursuing and working on. Are you recommending something like that because you have to accept all complaints that you receive as is, even though some, in your experience, could be set aside?

[Jennifer Stoddart]

Yes, that is more or less it.

[Richard Nadeau, Bloc, Gatineau, QC]

I come from teaching, where I sometimes worked as a vice-principal. Lord knows, I have had to set priorities in my time. Ten per cent of the students can take up 90% of our time, and vice versa.

Let me look into the future. I understand that this is a one-year budget, but you have to come back to it each year. We often use the things that have been done to decide whether to approve more money, or less, in the future. With a budget of $22,300,000, how will you be able to meet needs that can only increase?

We can also see a backlog. Of course, you will be able to tell me why and tell me how complicated the cases are. Perhaps there will not be an explosion of cases, but these sneaky people can use a number of ways that already exist to attack people's privacy.

I do not want to be a prophet of doom, but can you handle all the possibilities with a budget of $22 million?

[Jennifer Stoddart]

As I told your colleague, the Privacy Commissioner's budget has increased significantly in the last five years. We are going to start by using all the resources we have been given to recruit and train 178 people, and keep them to the extent possible, given the extremely mobile labour market. We are going to do everything we can to meet our goals before asking for more resources.

We have not yet exhausted everything we can do with our current resources. I feel that it is very important to be innovative, and not always be asking for more resources. We have plenty of resources and our role is to work strategically and creatively to face the new challenges.

[Richard Nadeau, Bloc, Gatineau, QC]

Those are wise words, but I know perfectly well that things can change. Demand can increase significantly. At the moment, there is no mechanism that would stop someone who knows how to make requests from messing up the system

[Jennifer Stoddart]

Not really, no.

[Richard Nadeau, Bloc, Gatineau, QC]

For the recommendation to be accepted and to help the budget, accepting that it could be subsequently changed by others, do we need to change the mandate of the commission as defined in the act, or could it be done more simply?

[Jennifer Stoddart]

The recommendation is quite straightforward because the powers that I am asking for are already in the legislation that is before a parliamentary committee. It is not a very bold request. It is something that I hope to see in the new legislation, something, in fact, that is already there.

Because of the resources that I presently have, I hope to be able to spend less and less time dealing with the same complaints always coming from the same people, and everything you can imagine that goes with that, and more and more time on structural matters like the ones some of your colleagues have mentioned.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you very much.

Thank you, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

Mr. Stanton, please.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you, Mr. Chair.

Welcome, Madam Stoddart. It's good to see you back here.

I too am returning to this committee from the last session, but I recall we had fairly considerable discussions at the committee in the last Parliament in respect to the review of PIPEDA. I notice in your RPP that you have been given considerable funding or, in the words of the report, “approval to stabilize funding for PIPEDA”.

I wonder if you could give us an update on what in fact that translates to. What sort of changes in activities have taken place to stabilize that and to put in place the resources to respond to the demands of PIPEDA across your organization?

[Jennifer Stoddart]

That takes us, I guess, back into the history of the funding of the office. When PIPEDA was originally voted for in 2000, it didn't have permanent funding, because nobody knew how it was going to play out. So I think that's a comment that not only was the base stabilized, but also that there was a need for various things such as technological experts, and a need to communicate with our international colleagues in terms of the technological applications that are being rolled out throughout the world, and various things like that, including having technical advisers in a lot of the different branches to have a hands-on approach to doing either investigations or audits in an updated way.

So all of that was rolled into our present budget, and it has been extremely useful.

[Bruce Stanton, Conservative, Simcoe North, ON]

I know you made brief mention of the whole question of the requirements of industry to disclose any data losses. We spent considerable time debating the pros and cons of the best direction to go forward there.

Have there been any changes to the experience your office has seen with respect to the voluntary approach and how that has been working? Are you finding that industry is participating well? Are they putting regimes in place to make sure those losses are disclosed, at the very least, to your office?

[Jennifer Stoddart]

We've seen a very positive take-up. The first year when we had voluntary data breach disclosure--and this may not be accurate, from memory--there were something like 25 self-reported disclosures. I think there were 69 last year. As always with such things, one wonders if there wasn't a lot of activity going on that wasn't reported, and what this reflects--more cooperation with my office, greater data breaches, it's hard to say.

What I can say is that throughout the world in societies that resemble ours, we're moving to compulsory data breach disclosure. The European Union recently recommended this, and I believe President Obama is talking about a national data breach disclosure. There's some debate about that, because right now standards in some of the states are a bit higher than a possible national law. We follow up on all the cases to make sure that remedial action is taken.

[Bruce Stanton, Conservative, Simcoe North, ON]

One of the key objectives of your office is to expand the outreach side. Could you comment on whether some of the outreach activities are in fact having some positive results in areas like reporting of data breach, and that type of thing?

[Jennifer Stoddart]

One of the things I'm very concerned about is taking the office out of Ottawa, which is not home to a great number of Canadians, and out to the places where people are living and working. On the money we've had for regional presence, we're not the size to have an office. But I think it's very important, because in all fields you have to maintain personal contacts. We have a regional presence in the Maritimes and in the west in Calgary. I think this has been very useful in developing our links and a trusted relationship with the private sector.

As far as the public sector goes, we work extensively with the other commissioners. We have joint initiatives like the youth privacy website, youth initiative, children's privacy, electronic drivers' licences, and so on. It think it's an important part of our action.

[Bruce Stanton, Conservative, Simcoe North, ON]

Thank you very much, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

Mr. Siksay, please.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thanks, Chair.

Ms. Stoddart, in your remarks today you mentioned the Treasury Board Secretariat's 2008 Public Service Employee Survey, which showed a pretty happy workplace, by the sounds of it. Can you say a bit more about the results of that?

[Jennifer Stoddart]

They are happier, but again there are a couple of caveats. This is in contradistinction to the rather troubled history a while ago, which is well behind us, I think. Secondly, my office and the Office of the Information Commissioner, Mr. Marleau, are one reporting unit, so the answers are for double the reporting of a unit. But the answers have moved up, and 68% of our employees responded to the e-survey. That's very positive, because employees who are indifferent.... We're in the middle of reviewing the data to give you more detailed answers on that, but the participation of employees is seen as a positive trend.

Last spring we were very proud of the Hill Times report that we were the 11th best place to work, along with the Information Commissioner. That was last June or July. We're in competition with a lot of large departments that can offer people career promotions for the rest of their lives. We try to emphasize that ours is a good place to work, not only because we try to balance work and family but because we try to run programs that ensure the wellness of employees at work.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Your remarks today are based on the participation rate, rather than specific feedback on the workplace itself.

[Jennifer Stoddart]

That's right.