Evidence of meeting #4 for Access to Information, Privacy and Ethics in the 40th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was complaints.
A recording is available from Parliament.
4:10 p.m.
Conservative
Kelly Block Conservative Saskatoon—Rosetown—Biggar, SK
Can you tell us some of the events and/or conferences you have attended in your role in the past 12 months?
4:10 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes. Let me try to think of this in reverse order.
In October I travelled to Strasbourg with members of my office to take part in the International Conference of Data Protection and Privacy Commissioners. We had hosted the event in Montreal a year before and had been invited by members of the committee. That conference was opened by the Speaker, Mr. Milliken, which was an honour for us and a link with our parliamentary function. We go to that every year.
Prior to that, outside the country I was with the ministerial delegation of Industry Canada in Seoul, South Korea, in the context of OECD work, where my office has been very active in drawing up cross-border procedures for the sharing of remedies in cases of mismanagement of personal information. I participated on a panel and was part of the discussion among the Canadian delegation.
Prior to that, I was in London giving a speech to an international e-crime conference about the lessons that could be learned from the joint investigation between my office and the office of the Information and Privacy Commissioner of Alberta on the TJX affair, which had to do with hacking into a TJX database and stealing some million credit cards. This had repercussions worldwide. The people are just being brought to justice, but millions of dollars in damages were paid out.
Prior to that, I was at the OECD for a working meeting. I think that's back to last March.
Does that give you an idea of what takes me out of the country?
4:15 p.m.
Conservative
Kelly Block Conservative Saskatoon—Rosetown—Biggar, SK
Yes, absolutely.
From reading your report and hearing what you're saying, it would appear you have played a lead role in some of the conferences you've attended. Can you tell me what you have learned at these conferences? And how do Canadian privacy laws compare with privacy laws in these other countries you have had the good fortune to visit?
4:15 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
There are two main things. One is that the Canadian approach is of great appeal. The privacy world is divided into three groups: people who don't have privacy legislation, then there are people who take an approach like the European Union does, and then the approach of the United States, which doesn't have overall privacy legislation. The Canadian version of this blends in both the European and the American approaches. So it's of great interest and great appeal because it adapts itself to many situations and many cultures.
However, that's the good thing. The sometimes depressing thing is the rate to which Canada has fallen behind in its privacy protection and the extent to which we are challenged in enforcing some basic measures. One honourable member raised the question of security. We have no data breach notification legislation, unlike that in most states. We do not have a system that really deters to any extent a lot of misdoing. Within our own government we have a very opaque system of management of personal information that needs to be seriously looked at. The average Canadian has no recourse. If the federal government misuses his or her information, there really is no recourse. You just have a right to get access to your information, but if they've misused your information and made some egregious mistake that causes you harm, as is the case of Mr. Murdoch from Edmonton, you cannot go to the Federal Court or any other court to say I suffered damage to my reputation, my livelihood, and so on.
These are some of the areas in which on the overall approach we're good, and on the details we've fallen seriously behind.
4:15 p.m.
Liberal
The Chair Liberal Paul Szabo
Thank you kindly.
The chair's going to use his discretion and jump in here.
Ms. Stoddart, does anyone from your staff have with them any of the latest material on your human resources shortfall and also the backlog on files with them here today?
4:15 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I believe we do, Mr. Chairman. We distributed some in the context of the appearance for the supplementary estimates, so we have that on human resources, which we could distribute to you.
4:20 p.m.
Liberal
The Chair Liberal Paul Szabo
I wonder if someone could be prepared just to come to the table if they have to to be able to--
4:20 p.m.
A voice
I could.
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
And we have some material on the backlog.
4:20 p.m.
Liberal
The Chair Liberal Paul Szabo
There was another item. In the joint audit that the Office of the Privacy Commissioner did with the Auditor General, where you presented the two excellent reports, both the Auditor General and yourself, with regard to four different departments, one of the concerns that you raised was pretty serious. It was that the legislation under the Canadian Elections Act provides that the birth date of electors now be shown on the electoral list. I think there were also some statements that some of this information was found in the hands of those who maybe shouldn't have it. When the matter was before Parliament, did the Office of the Privacy Commissioner identify that this was a potential problem, and did it appear before the committee or make any representations with regard to those amendments?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, to the best of my recollection, Mr. Chairman, I appeared twice. Once was with the director general of elections to talk generally about the use of identifiers and how they were handled in the context of defining who was an eligible voter. That was with the House of Commons committee. Then once the draft legislation was passed, I appeared at a Senate committee, as I remember, with the assistant commissioner from Ontario to express my concern about the full birth identifier, as the Ontario practice was the year only. This is from recollection. We could supplement that for you, but I did express concern about that.
4:20 p.m.
Liberal
The Chair Liberal Paul Szabo
Okay, and that's the practice, to monitor evolving issues that may have some privacy considerations?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, absolutely. That's what our staff does.
4:20 p.m.
Liberal
4:20 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Thank you, Chair.
Commissioner, why was the RCMP's Project Shock database closed down? What were the reasons given?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Well, once we had announced our intention to audit and once my staff began to discuss this with the RCMP, they came to the conclusion with us that many years after 9/11--it was set up in the context of 9/11, in the months following 9/11--they didn't need that particular information in an exempt bank and could therefore close it down. So it was in the context of our audit.
4:20 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
So the explanation is that it was excess information, as opposed to information that was garnered in a way that wasn't allowed or required. Is that correct?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I haven't reread our audit report since we launched it, but as I understand it, it was information that was no longer relevant to their needs; it was no longer useful. This was information that they thought might have been of strategic importance in 2001, but certainly isn't now. And it had never been reviewed, so that for most of it, I gather, the exempt status was removed.
4:20 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Were gentlemen like Mr. Arar perhaps on that database?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't know on what particular database Mr. Arar may have been.
4:20 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Well, I'm asking about this Project Shock database that the RCMP closed down once you had begun looking at it. Was he on that particular database?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't know. I simply don't know personal information about who was in the database.
4:20 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Okay. Was that database shared with foreign governments?
4:20 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I'd have to look into the report. I don't remember that it was, but it doubtless could have been under Canadian law.