Evidence of meeting #32 for Access to Information, Privacy and Ethics in the 40th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was subamendment.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Elizabeth Denham  Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada
Carman Baggaley  Senior Policy Advisor, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada
Daniel Caron  Legal Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

9:55 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

The reasonable person, that's a legal concept. Reasonable safeguards.... The law is full of the word “reasonable”. There has to be a reasonable balancing, and that's really what we were striving for in our negotiations on street-level imaging. Is it a perfect resolution? No. Is it a reasonable balancing between an innovative technology that is very popular and individual privacy rights? We tried to get there.

I don't think that conversation is over yet. If we had a complaint and we did a full-on investigation, the company might argue an exception for journalistic purposes, an exception to the consent requirement. I don't know where that would go. What we tried to do was find a reasonable balance. Our law is based in e-commerce. It's supposed to balance commercial interest with individual privacy, and that's what we strive for.

10 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Further on in your presentation, and I'm just picking up on what Mr. Siksay had asked previously, you were talking about the implications of behavioural advertising, cloud computing, and geospacial technology on privacy. Could somebody please define those a little more broadly and less technically, please?

10 a.m.

A voice

Reasonably.

10 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Okay, reasonably.

10 a.m.

Senior Policy Advisor, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

Carman Baggaley

The easiest way, for example, to explain cloud computing is that the term “cloud” is really a metaphor for the Internet. Instead of information being stored on your own computer and you having to purchase the software to manage that information, you store information on a server and you don't even know where it is. The software is purchased or rented, in a sense, from the service provider. It's very popular, for example, with businesses. They don't have to invest in the software and they don't have to worry about securing the information. That raises privacy concerns, because the organization, the business in this case, no longer controls the information at its business site; it may be managed by a third party.

With respect to the reference to deep packet inspection, in the current communications environment, information is sent in what we call “packets”. It doesn't matter whether it's a telephone conversation or music, it's sent in individual packets and your conversation gets mixed up in various packets and then reassembled at the end.

For example, an ISP, or for that matter a law enforcement agency, has the ability to look at those packets as they go through a certain point. There are many uses for that, which are perfectly legitimate, to ensure that no one is trying to hack into that information as it's flowing past that point. However, the concern is that potentially people can inspect this information. They can look at it to hunt for key words, for example, which they may then want to use for marketing purposes. That's where the privacy concerns come in.

The reason it's called deep packet inspection is because it goes down to that level where you get a sense of what people are communicating about, the key words they're using.

I hope that helps explain, at least to a degree, those two concepts.

10 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Thank you.

10 a.m.

Liberal

The Chair Liberal Paul Szabo

I think we're there.

All right, Monsieur Desnoyers, please.

10 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

Thank you very much, Mr. Chairman.

Welcome.

First, unless I'm mistaken, three provinces are not covered by your report: British Columbia, Alberta and Quebec. Is that correct?

10 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

That's correct. There are substantially similar private sector laws in British Columbia, Alberta, and Quebec. Intraprovincially, our law, PIPEDA, doesn't apply. It applies in the rest of Canada, and it applies to data flows across provincial borders.

10 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

Consequently, the statistics we have concern only the other provinces.

This issue is indeed fascinating, and I agree with Ms. Davidson. We're talking about preserving confidentiality, information. We know that Canada exchanges a lot of information with the United States.

Are you consulted in those various exchanges, to determine whether there are confidentiality aspects? It's often said that the United States has more information on Canadian citizens than Canada does. Perhaps those are gratuitous statements, but it still intrigues me.

10:05 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

I want to add one more thing to your question about the application of the laws. PIPEDA applies in the other seven provinces, but it all applies to federally regulated industries, such as banks and telecommunications and railways, no matter where they operate. I just want to clarify that.

I will ask my colleague to address the second part of your question.

10:05 a.m.

Legal Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

Daniel Caron

The act imposes obligations on organizations to ensure, to the extent that the information is exchanged or sent to a country such as the United States, that individuals are informed of the fact that their information may be subject to the laws of another country.

10:05 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

So all Canadians concerning whom information has been transmitted by the Canadian government to the American government are informed.

10:05 a.m.

Legal Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

Daniel Caron

We're talking about exchanges of information between private organizations. The act covers the exchange and use of information in the context of private sector organizations. We're not talking about exchanges involving the Canadian government. An organization that would like to enter a client's information in a server located in the United States would have an obligation to inform that client of the fact, under PIPEDA and a confidentiality policy, and to inform that person that his or her information could be subject to the laws of that country.

10:05 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

So you aren't consulted by the Canadian government concerning those exchanges of personal information.

Are the governments entitled to exchange information with each other?

10:05 a.m.

Legal Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

Daniel Caron

I believe that agreements have to be established first. However, in the case of exchanges of information between governments, it's the Privacy Act that applies. That's a completely different act. The act we're discussing today applies to private organizations.

10:05 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

So strictly to businesses.

10:05 a.m.

Legal Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada

Daniel Caron

Yes, precisely.

10:05 a.m.

Bloc

Luc Desnoyers Bloc Rivière-des-Mille-Îles, QC

All right.

In your report, you state that a complainant can go directly to an organization or business to obtain information. If people are unable to make that kind of request, do you help them take the necessary steps when they file a complaint with you? Do you tell them where to go, what they have to do and how they have to proceed, or do you let them do it by themselves?

10:05 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

Our refer-back process is discretionary. Obviously if we felt that somebody were going to have a difficult time going back on their own, we would definitely help them. If it were an employee who has had a difficult relationship with their manager and wanted to file a complaint, we might not force them to go back to the organization in that circumstance. So we do have discretion in our refer-back policy. It's a very good point.

10:10 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you.

Mr. Poilievre, please.

10:10 a.m.

Conservative

Pierre Poilievre Conservative Nepean—Carleton, ON

Thank you.

On page 3 of your presentation you state:

I would like to address a common misconception that some companies have about photographing people in public places. If an organization takes a photograph of an individual in a public place for a commercial purpose—for example, when a company, in the course of photographing a streetscape captures an identifiable image of a person and the image is unloaded onto the Internet, for a commercial reason—Canadian privacy law still applies.

Would you agree that the most common exception to this rule would be the media, because of the specific exemptions written into the law?

10:10 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

I absolutely agree with you. If the capture of the image is for a journalistic or artistic purpose, and no other purpose, then consent is not needed and the publishing of that photo can go ahead.

We haven't had that argument put before us by a company to look at whether or not cartography is an artistic purpose. On the surface, I would say it doesn't look that way to me, but we'll see what happens. If we get a complaint, we will look at that thoroughly.

10:10 a.m.

Conservative

Pierre Poilievre Conservative Nepean—Carleton, ON

In his June testimony, Jonathan Lister of Google testified that he felt “there's an argument to be made” that digital photography initiatives, the kind his company has pursued, have a certain artistic use rather than a commercial one. Do you accept that argument?

10:10 a.m.

Assistant Privacy Commissioner , Office of the Privacy Commissioner of Canada

Elizabeth Denham

I would like it to be put to me directly, and we would consider it, but the act says it's for journalistic and artistic purposes and no other purpose.