Information & Ethics Committee on Feb. 11th, 2009

[Lisa Campbell]

Our legislative responsibility is under PIPEDA. The private sector legislation requires us not only to ensure compliance with the law but also to raise awareness about privacy issues across the entire population. There's actually a legislative mandate to do that, so this is part of that outreach and public education, and quite frankly, it also fits well with the ombudsman role. If you're trying to resolve disputes, you don't want to use compliance activities most of the time. You save those for the worst cases. Most of your efforts are directed at bringing people into compliance with the law because they want to, because they think it is good business practice. But it's not just business; it's also individuals.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

We're always trying to save some money for taxpayers, and I'm wondering if you can point to some potential savings within your organization.

[Tom Pulcine]

The history of the organization over the last four or five years has been one of going back to the Radwanski scandal of 2003. There has been a significant amount of effort over the last number of years to rebuild the office. A lot of resources have gone to that. At the same time as that was taking place in 2003, the legislation, PIPEDA, was not fully funded in the office. That legislation came into force in January 2000 in stages, with full implementation on January 1, 2004. That scandal took place in June 2003, so the resource base for the organization was not stable.

The business case reflected in the supplementary estimates here today I would think of as kind of the stabilization of the organization. I think the organization, in terms of managing resources, had to get there first before even being able to start considering where to cut or to reallocate. Over the last few years the organization wasn't healthy as it is today. It is only getting there now.

It is a fair question, and it's a question that is probably about two years premature--or maybe one year. We've had that conversation at the management table of the organization. We're at the point where the organization is going to be faced with choices.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I'm afraid I don't quite understand the answer. You said that because of the spending scandal that occurred now about five and a half years ago, you've not been capable of finding cost savings over the last half decade. Is it perhaps not time to say that yes, there was a spending scandal in 2003, but that doesn't stop us from imposing new spending discipline today?

[Tom Pulcine]

The point I was trying to make is that the organization with respect to the two pieces of legislation, specifically PIPEDA, had not yet matured in terms of the implementation of that legislation. There was no certainty that the resource bases that were there at that timeframe could support that act. So it's only, I think, at this stage, with the two business cases we did--the one in 2005 and the one in 2008--that the organization is stabilizing. Have there been reallocations during that timeframe? I think the answer to that question would be yes, but I'm not sure.

Lisa, do you want to add more to that?

[Lisa Campbell]

It was just to elaborate on what Mr. Pulcine said, which is that this new piece of legislation didn't come with full funding for what it asked the office to do. In other words, it asked the office to regulate all of the private sector in Canada except where there was substantially similar legislation. We had to see which provinces would enact legislation, and only three did. So we have to be there in every other province and territory to cover the private sector as its personal information-handling practices evolve.

So it's actually quite a large mandate, as well as the mandate I talked about to do outreach.

[The Chair, Liberal, Paul Szabo]

Thank you kindly.

Ms. Simson, please.

[Michelle Simson, Liberal, Scarborough Southwest, ON]

Thank you.

I just have a quick question. You elaborated on the new appropriations being used to eliminate backlog, which is easy to understand--the public outreach, which I would totally support. Can you just give me a bit of a breakdown as to what the function of the internal audit covers? “Audit” is a word you can use in various ways.

[Tom Pulcine]

Sure.

The internal audit is the policy that was revamped because of the Federal Accountability Act, and with that, all departments and agencies had to put in place an internal audit program. Internal audit, by definition, is a process where one looks at its internal operations. You study yourself and just find out if everything is working fine or whether improvements are required.

As part of our obligation to respond to that policy, we're asking for additional resources, with the support of Treasury Board Secretariat, to put in place an internal audit program. With that we have to set up an advisory committee. The majority of the members must be external to the organization. As part of that process, you would do a risk-based audit plan in which you would assess the risks of your organization and decide where you think an internal audit is appropriate. Basically having considered that audit plan, that committee would then make recommendations to the commissioner and then she would presumably approve certain audits that would take place. You would contract out those audits and then deal with the results of them.

[The Chair, Liberal, Paul Szabo]

Thank you.

Mr. Nadeau.

[Richard Nadeau, Bloc, Gatineau, QC]

Thank you, Mr. Chair.

Mrs. Campbell, you said that the information technology world—emails, electronics, and so on—is enormous, that it is here to stay, and that some people might violate other people's privacy. You are asking for appropriations for this year, and I understand that. However, I get the sense that, in the short, medium and long terms, there will be more and more privacy violations. You mentioned $376,000 for access to information and $322,000 for privacy. Those numbers will surely go up.

What do you plan to do?

[Lisa Campbell]

Are you asking about the number of complaints we receive?

[Richard Nadeau, Bloc, Gatineau, QC]

Yes.

[Lisa Campbell]

Currently, we get about 75 per month, and they are about evenly divided between the two acts. I would have to check with my colleagues to find out if that number has gone up.

[Tom Pulcine]

There's been a little bit of an increase with respect to PIPEDA this year, over the 12-month period, but for the most part it's stabilized—and likewise for both acts.

[Lisa Campbell]

I would say that complaints have become more complex, primarily due to the new act governing the private sector. Recently, the Federal Court of Appeal ruled on a case in which a U.S.-based company gained access to a Canadian woman's personal information. The court ruled that, even though the company was located in the United States, we had a legal obligation to investigate the matter.

Cases are becoming more complex and have a lot to do with technological change and what is going on on line. We are required to investigate. It is true that the number of cases has gone up, but the real issue is that the cases are becoming more complex.

[Richard Nadeau, Bloc, Gatineau, QC]

I understand. We could be dealing with some huge issues in the future. We are not here to make predictions, but I get the sense that the amount of money you are asking for today could easily go up in the future.

[Lisa Campbell]

Not necessarily, if the legislative amendments we have asked for are adopted. Earlier, I said that we wanted to work with our international colleagues. That would be a big help. We also asked for the power to sort through complaints and dismiss some of them if we have already ruled on the issue, for example.

Right now, we do not have much control over what we accept and what we dismiss. We do not necessarily need more money; we need more tools.

[Richard Nadeau, Bloc, Gatineau, QC]

I think we understand each other. Thank you very much.

[The Chair, Liberal, Paul Szabo]

Merci, colleagues.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

On a point of clarification, there was a commitment to provide the committee with some information. Could we get a commitment on a date when that information will be provided?

[The Chair, Liberal, Paul Szabo]

Is that on the five-year numbers, etc?

Actually, the committee is already in receipt of substantial statistical material from our review of the Privacy Act in the last Parliament, which we've rolled forward, and all members are going to get all of that information. So I think we have it already, and all honourable members will be getting all of the exhibits and all of the testimony, etc., on that area, where we are going to continue our work. It was the wish of the committee that we complete our work on privacy, so the information is there. We'll have a quick look at it.

Maybe the clerk or our researcher could check Mr. Wrzesnewskyj's request. I believe the history on the backlogs and staffing, the human resources issue particularly, is there. There are graphs and the whole bit, so I think we're in pretty good shape.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

Just as a quick second item, I referenced a document in my questioning, a briefing note to the Commissioner of the RCMP, and it would be proper for me to table this particular note with the committee.

[The Chair, Liberal, Paul Szabo]

All right. We'll have that circulated to the committee members when it's appropriately translated.

Thank you, Mr. Clerk.

Mr. Pulcine and Madam Campbell, thank you kindly for attending on such short notice and being responsive to the questions of the members.

We'll get more opportunities, and indeed, we have already decided to have sessions with—

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Chair, I do believe there are more questions to ask.