Evidence of meeting #4 for Access to Information, Privacy and Ethics in the 40th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was complaints.
A recording is available from Parliament.
4:50 p.m.
Privacy Commissioner , Assitant Privacy Commissioner
I would simply add that indeed it is a work in progress. Last week the privacy commissioners of Canada were together in Ottawa and decided to create a working group precisely to systematically address these concerns together in a concerted fashion.
4:50 p.m.
NDP
Bill Siksay NDP Burnaby—Douglas, BC
Do I understand correctly that the pilot project is only involving 500 volunteers?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
That's my understanding. It's going on in B.C; it involves 500 volunteers, and it is still being studied.
4:50 p.m.
NDP
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, it is.
4:50 p.m.
NDP
Bill Siksay NDP Burnaby—Douglas, BC
Is there any other government-issued ID that contains an RFID chip that you know of?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Doubtless there would be in many secure establishments, but I don't know offhand which ones; we haven't inventoried them. But it's getting to be a fairly commonly used technology.
4:50 p.m.
NDP
Bill Siksay NDP Burnaby—Douglas, BC
Is that something you plan to do more work on, given the kinds of concerns you've raised about RFIDs? Is there a timetable on that?
4:50 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
It's an ongoing concern of ours. It was one of the big themes of our annual report about two years ago.
Certainly as RFIDs spread through the marketplace we will be monitoring them very closely. Right now we understand they're being introduced into the merchandise supply chain at the pallet level. That is acceptable to us, if it stays at the pallet level. Let's say goods come from Asia. A certain percentage of them are lost at the dock, in transit, in shipping, with the trucking and so on. They are damaged and can't be used. There's a fair amount of wastage to wholesalers and retailers. We've been told that the RFID would help to individually track each pallet. I also believe there are national security reasons for tracking pallets of goods because you don't know exactly what they contain. That is fine.
The problem is when you break the goods out of the pallets. Let's say there are shoes being sent from Brazil. Do you have an RFID in each shoe so you can account for theft, people walking into the store putting on new shoes and walking out? If so, the privacy implications are enormous. There is one unique identifier in every RFID that can emit your location to a reader. If there's not some way of either preventing the RFIDs going in at an item level or turning the RFID off at the point of purchase securely, you could track where people are going or link it up to the card they paid with.
4:50 p.m.
NDP
Bill Siksay NDP Burnaby—Douglas, BC
I have one more quick question.
One of the things you talk about in the report is the no-fly list. You said that you did a privacy impact assessment of the passenger protect program, but you also talk about doing an audit of the privacy management practices of the passenger protect program. I'm wondering what the difference is between those two things. It sounds like one's been done and one's coming up. What's the one coming up going to look at that the completed one didn't?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
The one coming up is going to look at how this system was administrated--for example, how many people went through it, the criteria on which they could fly or not fly, how many made use of the recourses in what I think is called the Office of Reconsideration. It's basically how the program is administered from a privacy point of view.
Mr. Chair, could I ask my colleague Lisa Campbell to talk to you about a case we're monitoring in the Federal Court on the do-not-fly list?
4:55 p.m.
Lisa Campbell Acting General Counsel, Legal Services, Policy and Parliamentary Affairs Branch, Office of the Privacy Commissioner of Canada
It's an interesting case. The name of the case is Hani Al Telbani against the Attorney General of Canada and Transport Canada. It's the first challenge in court, that we know of, to Canada's no-fly list. At the moment they're exchanging documents. An interesting side issue is that the applicant has asked for access to Transport Canada's documents. That's really what's at issue; he wants to know why he was denied boarding a plane. He asked that his name not be published, and the media and the Department of Justice intervened and said that because of the open courts principle his name should appear. He's in an interesting situation of perhaps never knowing why he couldn't get on a plane but his name is associated with this list.
4:55 p.m.
Liberal
4:55 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
How many foreign governments do we share Canadians' personal files with?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I can't answer that question, Mr. Chairman. I've pointed out many times that the Government of Canada has a very opaque system for sharing personal information with governments abroad. It's one of the recommendations for reform of the Privacy Act.
I think the law talks about an arrangement or an agreement—that's a fairly informal way of agreeing to share personal information, as compared to, for example, placing before Parliament, even just for its notification, all the MOUs with foreign powers as to what kind of information we share. It's really impossible to tell exactly in detail what information is shared.
4:55 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
So we're in a current situation where even you, as the commissioner in charge of privacy, can't tell us how many governments and with which governments in particular the Canadian government is sharing personal, private files of Canadians. Is that correct?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, that is correct.
4:55 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Do we know what kind of data it shares with those countries? If we don't know the full list of countries, do we know what the limitations are on the type of data it would be sharing with this unknown number of countries?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
I don't believe the Privacy Act places any limits on the kind of information that can be shared abroad.
4:55 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
This appears to be probably one of the largest holes that need to be addressed.
Going back to a different part of your audit, dealing with passports, it was noted that there was a whole series of security issues and concerns, privacy breaches or breaches involving passports. Do you have a numerical breakdown of how many involve passports that were lost and stolen—which is one type of category—and how many actually involved internal breaches, whether within the offices here in Canada or in our missions abroad? Do we have a breakdown between the two?
4:55 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
My report didn't include such a breakdown. Now, the passport office itself may have that kind of breakdown. We were looking at their practices, their approach to protecting privacy. Any particular incidents would be tracked by that agency.
4:55 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
I noted that the report also stated that in many of our missions we use locally hired staff, and in a number of those missions it's just impossible to do proper security background checks on that staff. Is there a list that can be provided of how many Canadian missions abroad are using locally hired staff that we have no background checks on?
5 p.m.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Doubtless one could be by DFAIT. We simply did a sampling of a couple and found this, but we don't have an exhaustive list.
5 p.m.
Liberal
Borys Wrzesnewskyj Liberal Etobicoke Centre, ON
Perhaps this is another area that should be looked at.
In those countries where we are able to establish security clearances, are they based on information provided by the host country, or are they independently verified by our own staff? Are we actually asking a foreign government to provide us with security clearances for people who might have access to sensitive information within embassies and consular sections?
