Information & Ethics Committee on Nov. 19th, 2009

[Jennifer Stoddart]

The previous standard was that the file was unassigned. You could assign files and then the parties could be talking sometimes for years. That wouldn't be in a backlog.

I'm happy with this new standard. It's a clear, objective standard. But one of the things that happened then was that a lot of files that previously weren't defined as backlogged went into the backlog, and then we had administrative challenges, and so on. So things got a lot worse before they will get better, which is why our present figures are not great. The good news is—I am sure, and I have asked—that by the end of March all files that we've had for over a year will have been dealt with under the Privacy Act.

[The Chair, Liberal, Paul Szabo]

Do you have one quick question?

[Bob Dechert, Conservative, Mississauga—Erindale, ON]

I want to ask you about your comment, on page 3 of your remarks this morning, about our relations with foreign intelligence partners and sharing of information. Can you describe how Canada's system compares to some of those foreign intelligence partners?

[Jennifer Stoddart]

Honestly, honourable member, no, I can't. Traditionally, as you know, in the last few years this has been a challenge. We've said that when it's not done precisely and carefully there can be huge human consequences. Some of our preoccupations in the recent FINTRAC audit were that somebody could get into an unsubstantiated database and make a decision based on that when in fact the evidence isn't there to back it up. It's a general concern.

[Bob Dechert, Conservative, Mississauga—Erindale, ON]

Would it be possible for you to report back to us on what happens in the U.S.?

[The Chair, Liberal, Paul Szabo]

Thank you, Mr. Dechert.

Mr. Dorion, you now have the floor.

[Jean Dorion, Bloc, Longueuil—Pierre-Boucher, QC]

Thank you, Mr. Chairman.

Madam Commissioner and Madam Assistant Commissioner, welcome to this committee.

Ms. Stoddart, thank you for the political independence your report exemplifies. You do not hesitate to say, among other things, that you were disappointed by the government's refusal to reform the Privacy Act.

Our committee received—I expect that you were informed of this—a response from the Honourable Rob Nicholson, Minister of Justice, to a report we had submitted to the government. The minister entitled that response: “Government response: tenth report of the Standing Committee on Access to Information, Privacy and Ethics [...]”. Our report was tabled in the House of Commons on June 12, 2009.

In his response, the minister refers to the fact that in our report, we made five recommendations that you had yourself submitted and which were included in the 12 recommendations in your own report. More particularly, the minister said that we had chosen 5 of the 12 recommendations you made.

Are you of the opinion that this committee's report defended your positions well?

Among your own recommendations, are there any you would have liked the committee to give greater attention to?

[Jennifer Stoddart]

Thank you for your questions.

Of course, I would have liked to have seen the committee endorse our 12 recommendations without hesitation. However, I'm very happy with this report because first of all, it is the most serious review of this act that has been carried out in 20 years. Indeed there was a long period of time that elapsed during which there was no review. So this is a very serious review. Secondly, I'm very happy with the fact that this committee was able to unanimously endorse about half of my recommendations. As for the others, I don't think they were just rejected out of hand. It could have been that they concerned very complex issues. I note the fact that further studies were suggested.

[Jean Dorion, Bloc, Longueuil—Pierre-Boucher, QC]

Were certain aspects not chosen that you would have liked to have seen in the report?

[Jennifer Stoddart]

You are talking about aspects concerning which you had recommended further studies?

For instance, on the matter of the processing of complaints and recommendation No. 6, where you suggested that I be given the discretionary power of discontinuing or refusing to process certain complaints, I would have liked to see the committee support that recommendation unanimously. In fact, I hope that I will be able to obtain this power in the act with regard to the private sector. And thus, if I can do this for complaints that come from the public concerning a business, it seems to me that I could also do so in the case of complaints against the government, its departments and agencies.

And don't forget that if I make a mistake, the Federal Court can let me know and bring me back into line.

[Jean Dorion, Bloc, Longueuil—Pierre-Boucher, QC]

In this year's report, we can see on page 82 that 187 complaints out of 990 were discontinued, and that 121 of these concerned access and 38 concerned use and disclosure. As citizens, we know that it can be very frustrating to file complaints and to see that treatment times may be very long, to suspect that there may be ill will on the part of people who are following up on complaints or dragging their feet, and so forth.

What, in your opinion, is behind the discontinued complaints? Perhaps there is less of a tendency to study complaints that were discontinued rather than the ones that were maintained. Do you have an explanation as to why people file complaints and then withdraw them?

[Jennifer Stoddart]

There are probably several reasons. In order to have a better idea, we would have to do a cross-check with the nature of the complaint. Sometimes people have unrealistic or inaccurate expectations with regard to what we can do or what we can obtain for them. I'm thinking in particular of people who believe, because they watch a lot of American television, that if they turn to us, we will be able to sue the government and obtain compensation for them. But we cannot do that. And so they get discouraged or feel that it is not worth going forward.

There are also processing times to be considered. We are living in an era where a simple click of a mouse can cause things to happen. And so, the fact that the process is slow—which is one of my concerns, and I don't hesitate to say so—is certainly a factor.

[The Chair, Liberal, Paul Szabo]

They do happen. They do, and sometimes they're not the right things either.

Mr. Poilievre, please.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Thank you.

My questions pertain to the modern technological environment in which our privacy laws operate. There have been high-profile discussions about privacy issues related to both Google and Facebook in the last several months, discussions that I think in Canada have been very positive, starting with Facebook.

You and your office are credited with having done some good work with Facebook to establish norms of data retention and policies for the deceased who had Facebook profiles. To Facebook's credit, it has been very responsive to that discussion, and it has come forward with some very innovative and positive solutions to those privacy problems. In Google's case, their Street View technology has been adapted to meet the requirements that exist in our commercial privacy legislation. Both of these companies, I think, deserve some commendation for very innovative, prompt responses to the demands of privacy advocates and your office.

Do you believe that current laws equip us to deal with modern technological innovations like Google and Facebook? Or do you believe the transformation of our technological landscape requires that we update our laws?

[Jennifer Stoddart]

I'd say that as a matter of principle we should constantly be looking at updating our laws in terms of the...you don't know what adjective to use because the pace of change is so enormous in terms of communication technologies now. That is the role of those who look mostly at our private sector law.

In fact, there are some changes to it going through now. The government, I'm very happy to say, has introduced anti-spam legislation. That's a huge improvement. Also, PIPEDA is reviewed every five years, which is something that we've asked for in regard to this law, and I believe that's one of the things the committee endorsed.

So yes, as a matter of principle, we constantly have to look at this. Data breach is a huge problem. A lot of our report deals with data breaches in the government, and of course we know that outside of the government it's a huge problem.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

That's great, but you seem to have had some success with both of these companies using the existing statutes and the existing rules. Do you believe that the laws perhaps establish certain principles that can transcend the changes in the privacy marketplace, or do you believe we are ill-equipped to deal with those changes?

[Jennifer Stoddart]

No. I think our dealings with those two companies show the basic solidity of the Canadian law. One of the honourable members talked about Canada's role internationally. It's largely because there's huge interest in our law being a law with very high standards, but a flexible and practical application, one that can be adapted to different situations. I think the basic principles in the law are very sound. Our challenge is to adapt them.

I'd add one caveat, though. It is a consent-based law. Some of the discussion in international conferences now is about what consent is worth when we just click on to get to the next screen and click on “I consent”. None of us reads this. Even if we do read it and we are lawyers, we don't know what it means. As for how to have it enforced, if it were enforced, it would be two years from now anyway, so we just click on.

That is increasingly an issue. Should we go to another form of participation or should we make clear standards for some of these companies because the consent in legal terms is not meaningful? That is one of the ongoing debates, but for the moment, we've been able to adapt our law to the challenges.

[The Chair, Liberal, Paul Szabo]

Thank you.

I have Mr. Siksay, followed by Madam Block.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

I want to come back to the questions around privacy and the Olympics. I appreciate that you've had good cooperation from the ISU and the head of the ISU, Mr. Mercer. That was my impression as well, when I met with him on security issues related to the Olympics.

I wonder if there will be any monitoring or process in place to deal with any privacy complaints that arise during the course of the games. Is there going to be an examination after the games of what happened with regard to privacy concerns throughout the whole process of planning and operation of the games?

[Jennifer Stoddart]

Yes, we have discussed that with David Loukidelis.

I'll let Chantal Bernier answer. She's the one who is on this.

[Chantal Bernier]

The chief privacy officer who has been appointed would be the first line to receive any complaints, but our process would apply as well. Therefore, we would entertain any complaints that could occur.

At this point of course, we are trying to instill safeguards in the whole process. But hopefully we'll avoid that....

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Is there a plan to do an overall review of what happened with regard to privacy in the Olympics when the games are over?

[Chantal Bernier]

At this point no, unless you see that as being the conversations we have with the ISU. We are making sure we apply this review now. As I said, we sent them the questions we felt were relevant to hold them accountable in advance. We stated all the things we felt they should do, including training, appointing a chief privacy officer and so on.

We feel at this point that things are being so well handled that there may be no need for further intervention.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

With regard to large international events like the G8 and the G20 meetings, has there ever been...audit is probably the wrong word, but an audit of privacy concerns around those kinds of major international events?

[Chantal Bernier]

Not that I know of. I can tell you that in preparation for our holding the ISU accountable we have spoken to foreign counterparts who have been the data protection authorities at the time of Olympic Games. We have also looked at literature, research, on experiences around large events. There are academics who have looked at that specifically, and we have informed ourselves of their findings. In a nutshell, there are obviously unique situations where the imperatives of public safety are so great that they call for certain enhanced measures, which at the same time call for greater alertness towards privacy and an adaptation to the context.