Information & Ethics Committee on Feb. 23rd, 2009

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

I think that was a very good point to add.

My question is somewhat related. It concerns the comparative professionalism and success of government agencies and the private sector. Some might say there can be no comparison because the private sector deals with different kinds of information and perhaps less sensitive information than government. I would tend to disagree with those who would make such a suggestion.

We have banks that take very personal financial information, such as marital status, etc., to determine whether we qualify for loans. We have credit card companies that do the very same thing. We have credit bureaus, to which many private organizations have access, that have very private financial information included within them. We have counselling services, psychiatrists, and psychologists who keep extremely private and personal information about the daily lives of people.

Sometimes all of this data is contained in mass systems. I'm just wondering how government is performing in comparison to its private sector counterparts in protecting data and private information in the modern era.

[Jennifer Stoddart]

Unfortunately, I think we don't have the same indicators to measure them, but I think the Canadian government is doing fairly well.

When I make my reports, I focus, of course, and a lot of senior civil servants then get back to me, saying, “We did all these things well, and why are you just focusing on the part that we didn't do well?” Well, that's kind of my role. But overall I think the Canadian government has a good record in personal information handling.

Certainly senior civil servants are very aware of this issue and very sensitive to this issue. I think we're struggling a bit now because we don't have modernized approaches and modernized laws. We need, as I said, a little more leadership from Treasury Board, but then we remember that government and places like the income tax department have been dealing with confidentiality for years and years.

There are some places in the private sector, but not banks.... You can say that banks have been dealing with confidentiality, but they probably haven't been dealing with the sophisticated security issues the public sector has. That may be a bit ahead of them because of the strategic and military experience of the Canadian government.

I think the Canadian government stands up quite well when you look across the world at how various governments use their information, and it stands up well in comparison with our own private sector. It also stands up well in its respect for privacy rights of citizens generally. I'm not saying there aren't things that can be improved, but this traditionally has been an important part of Canadian life.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

My second question is also related to private versus public sectors and privacy protection. My question concerns your experience in examining the work of identity thieves. Do they succeed in stealing identities more often by use of government-issued documents like driver's licences and social insurance cards, or by use of documents issued by the private sector, like credit cards, bank cards, or receipts as record of payment, and birthdays? What is the source of the modern identity thieves' craft?

[Jennifer Stoddart]

Mr. Chairman, I'll ask our general counsel to answer that. I think she may have seen more data on that than I have. Thanks.

[Lisa Campbell]

That's a very good question. This is how it works: Data brokers have become an industry unto themselves. Personal information is now worth money, and it usually passes through many hands. There's not one identity thief, but several: there's the person who collects it, the person who sells it, and the person who makes money off of it. Ultimately you need to get to a valid piece of usually government-issued ID. But to get there, often what's collected is invalid, stolen, or borrowed pieces of personal information that can come from a wide variety of sources. The private sector is often where it originates, but usually identity thieves will need some valid piece or what looks like a valid piece in order to do a legitimate transaction. We have recommended a wide range of approaches, from better personal information handling practices to more restrained collection to disposing of information when you no longer need it, and then, ultimately, to criminal sanctions for the very worst case of identity theft.

Does that answer your question?

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

You gave me a spectrum.

[The Chair, Liberal, Paul Szabo]

Mr. Poilievre, we're already at six and a half minutes. But you've shared some, so that's okay. Those were good questions.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Is there not a way I could just get one final clarification there?

[The Chair, Liberal, Paul Szabo]

You could get on the list again.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Okay, consider me on the list.

[The Chair, Liberal, Paul Szabo]

Okay.

Mr. Siksay, please.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I've been thinking here, and I have just a couple of quick questions. Will the review you're now doing of the no-fly list program include the issue of racial and religious profiling as regards how that list has been administered, which has been a concern for some folks?

[Jennifer Stoddart]

I would think it would. I'm looking at my colleague because she supervises the department. I haven't seen the details of it, but I would think if that kind of profiling was going on, it would come out in our audit.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I have another quick question. You have called for a parliamentary review of the no-fly list, and that hasn't happened. Do you still think that's an important piece of work that needs to be done on the no-fly list?

[Jennifer Stoddart]

Yes, it is. Now that we have it before the courts, and given that there are so many issues—we just talked about identity theft and other things—it will be interesting to see what happens to this court case. Before you do a review, maybe wait for our audit, and then you will have more information.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I have a final quick question. You talked about the large number of complaints from people in the incarcerated population. Has that always been the case since the introduction of the act, or was there a turning point at which that began? Has there been any analysis of that trend line that would tell us that this is a new phenomenon, or is it a phenomenon that came from the very beginning of privacy?

[Jennifer Stoddart]

As far as I know, we haven't done one. We could go back to the annual reports. Certainly more of this has been reported in the last year. It's gone up in the last few years. But I've heard, anecdotally, for example, from people who were involved in writing the act--senior civil servants who were young civil servants at the time--who said that it had always been the case that the incarcerated population made use of the Privacy Act from its very beginning.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

So we don't know if there's some failing in another program that is disappearing, through which some of those concerns might have been channelled or answered in a different way before they became privacy requests, or whether something changed along the way that made it more likely to happen now. There's just annecdotal evidence.

[Jennifer Stoddart]

Well, we haven't looked into it. Given the challenges and particularly the backlog of complaints, we try to focus on our own work, but it might be an interesting study for someone to see what has changed in the life of those who are incarcerated such that they increasingly turn to the Privacy Act. However, that is not a question we've asked.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you.

Thank you, Chair.

[The Chair, Liberal, Paul Szabo]

Thank you.

Ms. Freeman.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

Ms. Stoddart, are you aware that computer chips are now being inserted in credit cards—I don't know whether you've looked into this with regard to driver's licences—and that, if a consumer doesn't want to have a card with a chip because there's no way to know what information is retained by the chip and people refuse to disclose exactly what information is contained in the chip... Bank credit cards are under federal jurisdiction. In fact, the banks are under federal jurisdiction. Are you aware of that situation?

[Jennifer Stoddart]

No, I wasn't aware that people were able to ask what information was on the chip and that people had refused to tell them. If we have received complaints on that matter, I am not personally aware of it.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

Are you aware that the banks are about to put that—

[Jennifer Stoddart]

Yes. And that's something they've been planning to do for a long time. It should be noted that the Europeans have had that card for a number of years now. The Europeans appear to have fewer problems with bank card or credit card fraud. They expect that will enhance privacy.