Information & Ethics Committee on Feb. 23rd, 2009

[Jennifer Stoddart]

My understanding from the study we did, which focused on personal information protection, was that when we talk about security clearances we talk about them in terms of Canadian standards. This means meeting the independent standard the Canadian government sets rather than simply saying that in another country, if the other country says that they pass their security clearances, they pass Canada's. Again, I think DFAIT could give you the detail you're looking for.

[Borys Wrzesnewskyj, Liberal, Etobicoke Centre, ON]

There were some high-profile cases of countries that are allies of Canada where it appeared they had government agents using Canadian passports. Has it ever been determined how Canadian identification, passports of Canadians used by foreign agents, had been acquired? Have we ever delved into that?

[Jennifer Stoddart]

I don't think my office has ever looked into that, no.

[The Chair, Liberal, Paul Szabo]

Thank you very much.

Mr. Dreeshen, please.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you very much, Mr. Chairman.

Thank you, Madam Commissioner, for coming here this afternoon.

As we are coming near the end, some of my questions are going to be somewhat disjointed, as they have been asked in certain levels before. Actually one of the things I'd like to talk to you about is something that Madam Freeman had mentioned earlier, and that had to do with identity theft.

You've addressed the threat that is posed by identity theft. Could you tell the committee your current view on the subject and address some of the recommendations that you would like to see included?

[Jennifer Stoddart]

Yes, I think with regard to identity theft there's a consensus. What I'm saying is neither new nor original. Identity theft is really one of the huge, serious law-and-order issues facing Canadians. The cost of identity theft has now just skyrocketed. A lot of it is borne by the intermediaries that are the credit card companies and the banks, but I think we have to look at this, because all this adds to the cost of Canadians purchasing goods and services through the use of credit.

There are very few Canadians who have not been the victim of some kind of fraud. And we use the term “identity theft” loosely, from credit card fraud right up to having your house sold out from under you, which has happened to some people. This is, I think, a priority for governments to act on. I've raised this question for a couple of years, and I would hope that this Parliament could return to the necessary amendments to the Criminal Code to help the police crack down on those who collect personal information for wrongful purposes more easily. There was a bill that was introduced, and I think there's one that is being reintroduced. So that is something very concrete that could be done.

Certainly education is important, and we mentioned the brochure we're developing. You can give it to your constituents if you think it would be appropriate. It is about how to prevent identity theft, how to be wary about this. March is fraud prevention month, so we cooperate with fraud prevention, the RCMP, an organization called PhoneBusters, to do a couple of activities. We have things on our website to raise awareness about this phenomenon.

[Earl Dreeshen, Conservative, Red Deer, AB]

And I suppose that's when you would tie in to some of the things that are happening with regard to Facebook, as well as with some of the problems? Could you elaborate on some of the concerns that parents should have in that regard?

[Jennifer Stoddart]

Yes. If I go to the children's online privacy issue, this has been a concern of many privacy advocates, many forward thinkers, for five or six years now, as we watch the Internet companies moving into the huge market representing our children and especially the group called “tweens”, who are about nine to twelve. Some of you may have tweens. They have their own websites that are very lucrative enterprises. They spend a lot of time on these websites. We had funded some research into the privacy implications for children and last June we launched an initiative with our provincial colleagues to really step up the information going to children and going to their parents about what to do and what not to do online.

So we've started our own youth privacy website, which is in conjunction with provincial commissioners, and we've also started a youth privacy blog. And then there's a section for parents on what to know when your kid first starts going online. I think I heard the other day that children are online now at two. As soon as they can recognize a letter, I guess they're online these days. So it has been a big priority for my office in the last year.

[Earl Dreeshen, Conservative, Red Deer, AB]

Thank you.

You also mentioned provinces and so on. When you were talking about the tribunals that take place in Alberta, Quebec, and B.C., just how does that tribunal work? Could you explain how that differs from the process that is followed at the federal level?

[Jennifer Stoddart]

Yes, in the three provinces the commissioner administers what is called an administrative tribunal. For those who aren't from a legal background, it's like an informal mini-court specialized in that particular issue. In some of these cases, for example in Quebec, you will have lawyers appearing, arguing the cases. In others, such as in Ontario, most of the cases have what is called a paper hearing. They're done on paper. There can be a combination of both. The parties are named, so it would be Joe Blow against ABC Corporation in terms of how it handled his personal information, and then the decision is made public on the Internet, with “J.B. v. ABC Corporation”. That's how a tribunal works. The commissioner in the tribunal or an adjudicator to whom he or she delegates their authority can then make a binding order--do this with Mr. Joe Blow's information; stop collecting this; put in proper safeguards, things like that. That order can be appealed.

[The Chair, Liberal, Paul Szabo]

Thank you kindly.

We're going to have to move to your colleague, Mr. Lauzon.

[Jennifer Stoddart]

Okay, I can come back.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

Thank you very much.

It's a pleasure to have you here, Ms. Stoddart.

I must confess that I'm a guest here, just replacing someone, but I find the conversation extremely interesting and fascinating.

In a past life I was a public servant myself, and one of the things we dealt with was the speed of service. That was one of the determinants of the quality of our service. You mentioned that you have a 12-month target, and if an investigation is completed before 12 months, you've met the target. The number you have that aren't meeting that target is considerable. I read somewhere in your report that your average investigation lasts 14.5 months. In my past life, which was in processing unemployment insurance claims, we used to process 90% of them within 21 days.

I just can't imagine that you would build in a target that would go out that long. I'll tell you why I say that. When I was in a position similar to yours, and I was explaining to the upper echelon why I couldn't meet those targets on occasion, they would ask if it takes longer to process a claim at the beginning of the claim than it does 14 months out. I ask you that question. Why would you not process the claim?

Actually, I had a friend lodge a complaint, and I don't know if he ever got an answer, but he certainly said to me, “It's been four months, Guy. Can't you do something about it?” When I inquired about the four months.... I don't think anybody gets an answer in four months.

I wonder if you could make some comments about that.

[Jennifer Stoddart]

Yes, I certainly can.

First of all, the backlog is a very serious problem. It's our number one challenge now, and everyone throughout the Office of the Privacy Commissioner is turning their minds to overcoming this.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

Does it take two years?

[Jennifer Stoddart]

Yes, but as I indicated, the ways to make it disappear quickly are not there. If you look through the recommendations I made for both of our laws, I would like to have greater discretion as to which cases I have to take and which cases I don't have to take.

There are two phenomena. With respect to the Privacy Act, we have a certain number of people who come several times, who make a complaint every year because they want to know something in general. If we could simply direct them to our website to get the answer there, and so on, we could focus on something that would be of greater benefit to everybody.

This is a bit different from unemployment insurance claims. You either get your unemployment insurance extended or you don't. A lot of people simply want to know things. Some just want to complain about the government taking 31 days to process the complaint, even though they have the answer to the complaint. Those we have to touch with. That's for the public sector. I would like some streamlining of the law, because the administration of Canadian government is very different from what it was 25 years ago.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

Would you consider making the norm 90 days? I would like to make it 30 days, but to give you the benefit of the doubt, wouldn't it be better to put the norm at 90 days and work towards that? If I have twelve months to do something, I'll probably take twelve months. However, if I have three, I'll do it in three.

[Jennifer Stoddart]

Yes, and I'm not the only privacy commissioner in Canada to have this problem. Unfortunately, even if you put in the delay at a year, if you don't have anybody to look at this....

I've told you some of the challenges in the public sector. In the private sector, the challenges on some of the issues are so technologically complicated that they will need five or six people and a tremendous amount of technical assistance.

Look at the Facebook complaint, for example. There are apparently seven million Canadians on Facebook. One organization made a complaint about some of its fundamental operations, its pretty basic operations. You can imagine that we have quite a few people on the Facebook complaint, because it's relevant to so many people. Those are just some of the challenges.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

But, you see, that would be built in. If you were doing 90% within three months--

[The Chair, Liberal, Paul Szabo]

Sorry, but we have to be fair to all members.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

Sorry, Mr. Chair.

[The Chair, Liberal, Paul Szabo]

Mr. Poilievre, please.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I would be prepared to cede a little bit of my time if Mr. Lauzon just wanted to finish up that last point, Chairman.

[Guy Lauzon, Conservative, Stormont—Dundas—South Glengarry, ON]

I was just about to say that's built into the system. As an example, if your target was to do 80% or 90% of your claims within 90 days, for those harder cases--and we had those cases that went on for three months or whatever--the truth of the matter, with all due respect, is that you're almost building in failure if you're asking for 12 months. That was my point.

Thank you, Mr. Poilievre.

[The Chair, Liberal, Paul Szabo]

Thank you.