Evidence of meeting #4 for Access to Information, Privacy and Ethics in the 40th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was complaints.
A recording is available from Parliament.
3:35 p.m.
Liberal
The Chair Liberal Paul Szabo
Good afternoon, colleagues. This is the fourth meeting of the Standing Committee on Access to Information, Privacy and Ethics. The order of the day, pursuant to Standing Order 108(2), is a briefing from the Office of the Privacy Commissioner.
Today we have with us the Privacy Commissioner, Ms. Jennifer Stoddart. Welcome back to our committee. I understand that you have an opening statement to make, but you may want to start by introducing the colleagues you brought with you.
Yes, Mr. Poilievre.
3:35 p.m.
Conservative
Pierre Poilievre Conservative Nepean—Carleton, ON
Mr. Chair, I don't like to interrupt, but I was wondering if it would be possible, given the public interest in the subjects we'll henceforth be discussing today, to open the discussions to televised hearings.
3:35 p.m.
Liberal
The Chair Liberal Paul Szabo
Are there any comments from the members? It's something the committee would normally request in advance so as to make those necessary arrangements.
Go ahead, Madame Freeman.
3:35 p.m.
Bloc
Carole Freeman Bloc Châteauguay—Saint-Constant, QC
Mr. Chairman, if we had wanted this to be televised—
3:35 p.m.
Conservative
Pierre Poilievre Conservative Nepean—Carleton, ON
It isn't hard to start up the cameras. They're already here.
3:35 p.m.
Liberal
The Chair Liberal Paul Szabo
Thank you.
I understand that it would take some time to do it. We could technically do it, but I'm not sure, at this point, that the committee seems to reflect an enthusiasm for doing it or for taking our time for that now. So why don't we proceed?
Madam Stoddart, please introduce your colleagues, and let's proceed with your presentation.
3:35 p.m.
Jennifer Stoddart Privacy Commissioner, Office of the Privacy Commissioner of Canada
Thank you very much, Mr. Chairman.
It's a pleasure to be here again with the committee, our committee. As an agent of Parliament, we report to you.
With me today is Chantal Bernier, who's just joined us as assistant commissioner for the Privacy Act. You may remember
Raymond D'Aoust, who was assistant commissioner. His term ended in September and he was replaced by Ms. Bernier.
Also with me today is Lisa Campbell. I believe you met Lisa Campbell, our acting general counsel. She came up last week. Unfortunately, I had another engagement, briefing a minister, I think, on our upcoming report. She came with Mr. Tom Pulcine, who is just behind me and whom you'll recognize. Also here with me today are two other members of my staff: Éric Charlebois, who is our parliamentary liaison officer, and Ann Goldsmith, who's head of the policy section.
I'd also like to say, Mr. Chairman, that Elizabeth Denham, who is the commissioner for PIPEDA,
the Personal Information Protection and Electronic Documents Act,
is in Calgary this week and unfortunately can't be with us.
Members, Mr. Chairman, you can see that we've supplied you with a fairly thick binder of information about the Office of the Privacy Commissioner, about our statutory responsibilities, and about some of the issues currently preoccupying us, and we hope that you'll find it a useful reference.
As Privacy Commissioner, for those of you who aren't too familiar with what I do, I'm an independent officer of Parliament. I report to Parliament, which means through this committee, through annual reports, or through special reports.
My office, with its 160 employees, is responsible for overseeing two laws: the Privacy Act, which covers federal departments and agencies--this has just been increased through the Federal Accountability Act--and PIPEDA, which is short for the Personal Information Protection and Electronic Documents Act. PIPEDA, which was adopted almost 20 years after the Privacy Act, covers private sector organizations, including retailers, financial institutions, airlines, communication companies, and so on.
The objective of both these laws is to protect the privacy of Canadians by setting out the ground rules for how organizations collect, use, and handle personal information.
I'm going to continue by talking about privacy threats. I would be happy to elaborate later on the philosophical underpinnings of these laws, but suffice it to say that there has never been a greater need for them.
The threats to the privacy of Canadians are real and they are grave. For my Office, a major challenge is the fact that the list of issues we must address is long—and growing longer every day.
Technology, for all its benefits, has created unprecedented threats to privacy. I'm thinking here of surveillance technologies, electronic tracking devices, and biometric scans, among others.
Computer memory has never before been so plentiful and cheap, which makes it incredibly easy, not only to compile information about people, but also to cross-reference it, manipulate it, analyze it, massage it and sell it to the highest bidder.
Many businesses now see detailed personal information as essential to their marketing efforts. Governments are increasingly interested in personal information as part of their national security efforts.
And in recent years there has also been a growing recognition by thieves that they can make a lot of money by stealing names, birth dates, credit cards and other personal information. According to the RCMP, organized crime groups in Canada now see personal information as an important money-maker that complements their more traditional sources of income.
Many of the emerging risks for privacy involve incredibly complex technologies. My office needs to delve into highly technical matters, such as nanotechnologies, genetic technologies, and deep-packet inspection techniques, to name just a few examples.
Later this week my office is appearing before the public safety and national security committee on the review of the DNA Identification Act.
Adding to the complexity is the fact that many privacy issues are now global in nature. “Cloud computing” has entered our vocabulary. Data flashes around the planet literally at the speed of light, which challenges us to ensure that the personal information of Canadians is protected on the other side of the world.
Whatever we do within our borders will never be enough to protect Canadians' privacy abroad. So we work with other countries to develop a basic level of level of data protection around the world. To this end, my office has been a keen participant in a number of international privacy initiatives by the Organisation for Economic Co-operation and Development, or OECD, Asia-Pacific Economic Cooperation, or APEC, and other organizations.
Now I'll move on to the issue of legislative reform.
On the legislative front, you will recall that I appeared before this committee last year to talk about the mandatory review of PIPEDA. I am pleased to report that the process is continuing apace, and I look forward to amended legislation coming forward through Industry Canada in the near future.
I would also like to mention another significant challenge for my Office—the Privacy Act.
As I—and a string of privacy commissioners before me—have pointed out to parliamentarians over the years, this piece of legislation is seriously outdated and in urgent need of reform. To add a bit of perspective, consider this: when that law was passed, the Commodore 64 was a novelty.
Last spring, this committee launched an important review of the Privacy Act. I presented a list of 10 quick fixes that would bring some immediate relief. But, in the long run, the legislation needs a complete overall to bring it in line with the privacy challenges of the 21st century.
I know the committee has heard from many witnesses and I look forward to responding to their comments and speaking further on this issue with you.
In conclusion, reforms to Canada's privacy laws will have to start here, in this committee, with you. I would suggest to the honourable members of this committee that privacy is an issue that should be of concern to all Canadians, regardless of political beliefs.
The threats to privacy that confront Canadians may not always be apparent to the average citizen. Indeed, the risks are often subtle and nuanced. They don't tend to appear all at once, but rather in a stealthy and gradual manner and from many different directions.
Canadians cannot possibly defend themselves against such threats alone. They need a government that sees privacy as a human right and that sees personal information as a commercial asset that must be valued and properly protected.
As an officer of Parliament, my job is to support you in this important role. My office is currently developing materials for householders, such as information on identity theft, to help you talk to your constituents about privacy.
We look forward to working closely with you to ensure that the privacy rights of Canadians are protected, and I welcome your questions.
3:45 p.m.
Liberal
The Chair Liberal Paul Szabo
Thank you kindly.
You are probably aware that the committee has already discussed and agreed to complete the work on the study that we conducted. I think the only other thing before we get too far into that—and you may have already given this some consideration, but if not, I would appreciate it if you would—is if you think there are any other witnesses you believe this committee should meet. We have a draft report coming, but that doesn't mean we can't continue to top it up to ensure that the dialogue that we had is fairly reflective of the attitude out there in the privacy legislative sector. So I invite you to do that.
3:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Thank you.
3:45 p.m.
Liberal
The Chair Liberal Paul Szabo
The other aspect of this, which you haven't commented on, but which I guess we'll get into, and on which maybe you could start your mind whirling, has to do with the human resources issue. As you know, the committee expressed some significant interest and concern about the ability of the commission to discharge its responsibilities. It came out in the review of the legislation and in some of the recommendations or possibilities that were posed to us for improvements in the act.
But separate and apart from that, I believe that we were asking for—and Mr. Hiebert may recall this—updates or progress on the human resource initiatives and backlog issues, so that we could continue to monitor these responsibly and, if necessary, become more involved. It is a situation that exists not only in your own commission, but also, as you know, even in the Office of the Information Commission, and I suspect maybe in other areas too. This may be something that we would have to take up possibly with the Treasury Board, or another jurisdiction, to find out how we can facilitate relief of a very serious situation where you don't have the manpower to discharge your responsibilities. It comes down to that, very simply.
Anyway, so much for my comments. I'd like to be begin our first round with Mr. Wrzesnewskyj, for seven minutes.
3:45 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Thank you, Chair.
Commissioner, welcome.
I noted that in your reports the majority of complaints are about the RCMP. When you went through those complaints, approximately what percentage were valid complaints?
3:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We do publish a quite extensive cross-tabulation in our annual report.
While my colleague looks for that, perhaps I could say that, generally speaking, relatively few of the complaints are founded under the Privacy Act. It's only a minority of complaints that are founded under that act, which I guess is good news in terms of the privacy practices of most of the organizations. Some are settled in the course of the investigation.
We could give you that information later.
3:45 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
While it's being looked up, which particular departments within the RCMP do most of the complaints stem from?
3:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't know, Mr. Chairman, that I've seen that specific figure or that we've analyzed it.
That's quite an interesting question.
3:45 p.m.
Liberal
The Chair Liberal Paul Szabo
To the extent that we get into areas where it's a little detailed and you're not prepared to fully answer the questions with 100% confidence, I would suggest that you take the question and undertake to respond.
3:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I'll take it under advisement, yes.
3:45 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Okay, perfect. Thank you.
Are you aware of valid complaints stemming from ATIP requests that were released and ended up causing embarrassment, etc., in regard to people's privacy?
3:45 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I believe that we do have a few of those a year, but they're a rather rare occurrence, because the releasing department in these cases relies on the public interest override, if it is an issue of community safety or the general public needs to know something about it.
So it's discretionary. Even if somebody does complain, it's up to the department head.
3:50 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
So there have been complaints in the past. Like you said, there may have been community overrides and perhaps community safety issues at stake.
Have you ever come across a situation where a briefing note to the commissioner was released, a briefing note that touches upon a potential criminal investigation into the actions of a member of Parliament? One would assume, this being a briefing note from the commissioner, that immediately within the ATIP section it would cause people to be especially mindful and careful of how they proceed, combined with the fact that it touches on a member of Parliament and a member of Parliament's reputation.
Is it not quite unusual that an ATIP document would be released--in this case the briefing note to the commissioner--which would in fact identify one of the individuals, a potential individual in a criminal case that went nowhere? Mr. Bill Casey was identified in this document that was released publicly. Has anything as serious as this happened in the past with the ATIP section in any of the complaints you've seen?
3:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We have not done an analysis of particular issues such as briefing notes being released. As I say, the department heads do have wide discretion under the Privacy Act to release personal information exceptionally when they believe there is a public interest. We'll have to leave it at that.
3:50 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
I noted in one of the reports in our binder here what your office audit found about the RCMP gathering information. I'll actually quote it. They used a phrase to say that the RCMP was gathering information “in excess of what is allowed or required”. Was that information just beyond the scope of what's allowed or required? Was any of that information illegally obtained?
3:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Could I ask, Mr. Chairman, if the honourable member is referring to our special report on the exempt banks?
3:50 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
I believe it was your special report to Parliament in February of 2008.
3:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes.
Mr. Chairman, we did not study the question as to whether the information had been obtained illegally. That is not within our mandate. We just looked at the information and its relationship to the administration of the Privacy Act.