Evidence of meeting #10 for Access to Information, Privacy and Ethics in the 40th Parliament, 3rd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was year.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Jennifer Stoddart  Privacy Commissioner, Office of the Privacy Commissioner of Canada
Elizabeth Denham  Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada
Chantal Bernier  Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada
Tom Pulcine  Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

11:30 a.m.

Liberal

The Chair Liberal Paul Szabo

Order. This is the tenth meeting of the Standing Committee on Access to Information, Privacy and Ethics. Our order of the day, pursuant to Standing Order 81(4), is the main estimates for 2010-11, vote 45 under Justice, referred to the committee on Wednesday, March 3, 2010.

Our witnesses today from the Office of the Privacy Commissioner of Canada are: Ms. Jennifer Stoddart, Privacy Commissioner; Chantal Bernier, assistant privacy commissioner; Elizabeth Denham, assistant privacy commissioner; and Tom Pulcine, director general and chief financial officer, corporate services branch.

Welcome to all of you and to your other team members from the commission, Madam Commissioner. I understand that you have an opening statement for us with regard to your main estimates. I'd ask you to commence now.

11:30 a.m.

Jennifer Stoddart Privacy Commissioner, Office of the Privacy Commissioner of Canada

Thank you very much, Mr. Chairman. We're happy to begin.

We're of course very grateful, once again, to be able to come before you to report on what we plan to do with the budget, which we hope you will vote for us in this present session.

I'd like to say first that I greatly appreciate the positive, productive relationship that my office has enjoyed with this committee over the years. I particularly appreciate the unwavering support you have shown for our goals, our initiatives, and our evolution. I will address all of these in short order.

First of all, I'll start with the question of human resources, which has often come up before this committee. As you know, Mr. Chair, my office has undergone a great deal of change over the past seven years, since I first appeared before a parliamentary committee.

Thanks to stable and appropriate funding from Parliament, we've been able to attract and retain the full complement of managers and employees needed to carry out our agenda. For example, we have hired and trained more than a dozen investigators to help us tackle a serious backlog of complaint files. We've also bolstered our in-house expertise in the all-important area of technology, with targeted hiring of some very knowledgeable people.

We have reached out to younger people so as to inject a level of energy and vibrancy into our organization. Some of these younger people are with us today. They are the next generation of privacy specialists.

I'd like to quickly go over some of our accomplishments in the last year.

Last week, as you may have noticed in the media, we joined data protection authorities from around the world in expressing deep concerns about Google and other global technology leaders for introducing new applications without due regard for the privacy norms and laws prevailing in our respective countries.

Last July, we published our findings into an investigation into the privacy policies and practices of Facebook, highlighting concerns about the company's transparency with respect to its use of personal information.

On the public sector side, we worked with the integrated security unit of the Vancouver Olympic and Paralympic Games to ensure that privacy rights were respected before, during, and after the Winter Olympic Games.

We also scrutinized the many new security measures affecting international travellers, particularly the full-body scanners now being rolled out at Canadian airports.

We, along with our provincial colleagues, alerted parliamentarians to the privacy concerns in legislation aimed at giving Canadian law enforcement, national security agencies, and others broader powers to acquire digital evidence to support their investigations.

Another topic that has come up frequently in this committee is the question of our backlog. We're very pleased about the recent resolution of a long-standing backlog of complaint investigation files older than a year.

The backlog problem had grown to unacceptable proportions in the past several years. With targeted funds that we received from Parliament in 2006, we were able to hire new investigators and appoint key people to streamline the intake function, and we re-engineered entire systems and processes.

The backlog has now been eliminated. Moreover, we have put in place new measures, such as an emphasis on early resolution of complaints, to ensure that we do not fall behind again.

With the complaints backlog out of the way, we can now focus on more systemic issues and better service to Canadians.

I will now move on to the four policy priorities. We can also reflect on the bigger picture: the current and emerging challenges to privacy, in this country and globally, and how our office can continue to make a difference in the lives of Canadians.

In that context, we continue to advance our work in the four policy issues that we anticipate will most dramatically affect privacy in the years ahead: national security, information technologies, genetic technologies and the integrity of people's identity.

We have been deepening our understanding of these important issues through comprehensive research, increased public education and participation in policy discussions with a wide range of experts and other stakeholders.

Over the past year, we have also been examining our other core activities to ensure we are serving Canadians in the most effective manner.

For instance, we are retooling our processes for auditing compliance with our two acts. We are also transforming the way we review privacy impact assessments so that our activities are guided more explicitly by analyses of risk and alignment with our identified priorities.

With an eye to better service delivery, we were also encouraged by Parliament's progress on ECPA, the Electronic Commerce Protection Act. While Industry Canada has the lead on this initiative, my office, the Competition Bureau and the CRTC will ultimately share an oversight role.

I know that Assistant Commissioner Elizabeth Denham appeared recently, accompanied by Tom Pulcine, to discuss the supplementary estimates attached to this initiative, and we appreciate your support of those estimates.

Thanks to amendments to PIPEDA embedded in the legislation, ECPA would give me the authority to be more selective in the investigations we pursue, thus enabling us to focus on more complex or systemic issues.

Another laudable aspect of ECPA is that it would deepen our capacity to share information with other data protection authorities, in Canada and abroad. Collaborative enforcement has become essential in this globalized world, where data flows unimpeded across borders. The need for collaborative enforcement was made clear with last week's joint initiative related to Google.

For these and other reasons, we sincerely hope this bill will be reinstated and passed during this parliamentary session.

To continue, I'll talk a bit about legislative reforms and alternatives.

We also look to this committee's support for other measures that would allow us to better deliver on our mandate. For instance, while we accept that amendments to the Privacy Act, which we have discussed intensively in this committee, are not moving forward at this time, we are implementing a range of administrative alternatives.

For example, we are helping to improve privacy training among public servants, encouraging data breach notification as the norm across government, and ensuring that all privacy impact assessments, called PIAs, embed an assessment of necessity, a bedrock principle of privacy protection.

To underline our impact in the latter area, I want to note that the number of PIAs submitted to us rose from 64 in 2008-09 to 102 in the past fiscal year. We've also been reaching out to departments and agencies, individually and through a very successful PIA workshop, to make sure they understand what we would expect a good PIA to include.

Meanwhile, under PIPEDA, we look forward to further amendments that would make breach notification mandatory, as a means of better protecting the personal information of Canadians.

I'd like to talk now about the consumer consultations we'll be holding in three major Canadian cities in the next few weeks.

PIPEDA, the private sector law, also enters another review period next year. To inform this process with a further understanding of key emerging issues with important impacts on privacy, we're about to launch a groundbreaking consumer consultation on the online monitoring, tracking, and profiling of consumers by business, and cloud computing technologies.

All the members of this committee were sent invitations to these consultations, which will also be webcast across Canada. The first one is on Thursday of this week, in Toronto, with Montreal following in May, and Calgary in early June.

We have been working very hard to expand our office's presence across Canada. A quick scan of our website will reveal a plethora of fact sheets, guidelines, videos, youth competitions, blogs, and other products. Also, you can now follow us on Twitter.

In an approach supported by Parliament, we are also expanding our presence in the regions. We have bolstered our presence in Atlantic Canada and increased our activities in Quebec and in the west.

We are also establishing a satellite office in Toronto. Like Parliamentarians and many of our stakeholders, we feel this is a sensible initiative since so many of the companies we regulate under PIPEDA are headquartered there. We will be making use of existing resources for this work, so we're not asking for additional resources from Parliament at this time.

In conclusion, I've touched on but a handful of our activities over the past year and our plans for the year ahead. I hope I've been able to show you how we're pursuing our corporate priorities, which you know about but which remain unchanged. I'll just remind you that they're about improving service to Canadians; helping individuals, organizations, and institutions make informed privacy decisions; advancing global privacy protection for Canadians; furthering our priority privacy issues; and strengthening our internal capacity so the office can continue to carry out its mission for many years to come.

Mr. Chair, I understand that in this session the members are also interested in the issue of video surveillance. We would be happy to answer their questions. We've brought some materials, such as our guidance on video surveillance for public and private sector organizations.

And of course, we would be happy to answer the questions you have, Mr. Chairman.

11:40 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you very much, Commissioner, and thanks to your team, for obviously a very busy growth period.

We're certainly pleased to hear about the human resources stabilization. I don't have the actual numbers, but just to tidy this up, can we have your turnover information and current vacancies?

11:40 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Our projected unplanned turnover for the year is, I believe, 14%. I believe the honourable members do have some statistics on our office HR resources.

Of the departures last year, half of them were planned and half unplanned. The planned are people who retire; the other half is made up of students, term workers, and people who accept transfers and promotions elsewhere in the public service. At the present time, I believe we have six unstaffed positions of the 173 that have been accorded to us by Treasury Board.

11:40 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you.

That tells me that the Privacy Commission is back in business.

11:40 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

11:40 a.m.

Liberal

The Chair Liberal Paul Szabo

That's terrific.

Mr. Easter, please.

11:40 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Thank you, Mr. Chair.

Welcome, Commissioner and colleagues.

I will admit that I never, ever figured that the Privacy Commissioner would end up on Twitter.

Even I won't use Twitter; I might say something foolish, Pierre.

11:40 a.m.

Conservative

Pierre Poilievre Conservative Nepean—Carleton, ON

That's impossible.

11:40 a.m.

Voices

Oh, oh!

11:40 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Honourable member, we're not on Facebook--

11:40 a.m.

An hon. member

[Inaudible--Editor]

11:40 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

No, that's true.

On your consumer consultations in your report, your remarks, this is an area that we hear a fair bit about, that for people using credit cards and everything else, there seems to be a profile established on individuals and then they're targeted for certain advertising and so on. Is that what you're talking about in these consumer consultations? Can you give me a little more information on that?

11:40 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Yes, we're talking about that in, I believe, two of the three consultations. I'm fortunate to have very talented and knowledgeable assistant commissioners who in fact are shouldering a lot of the day-to-day burdens.

Could I ask Assistant Commissioner Denham, who has organized these workshops, to give you more details?

11:40 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Go ahead.

11:40 a.m.

Elizabeth Denham Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

The consumer consultations in Toronto and Montreal are indeed focused on the kind of profiling and tracking that happens with online advertising. We're trying to understand how industry, technology, and the business models work.

We are trying to get from academia, industry, and consumers their views on the way personal information is collected and profiles are developed for advertising. We will produce a policy paper at the end of the consultations that will help us grapple with whether or not our laws are up to regulating the new technologies and the new online tracking.

11:45 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Thank you.

In another area, we understand that you've done a number of investigations over the last year into privacy matters. Some investigations we're aware of; no doubt there are some that we're not. Can you list for us what those investigations are? Are you required them to make them public? What's the procedure there?

11:45 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

We are required to keep confidential the details of the investigation, in fact, or the identity, shall I say, of the organizations and the people involved. We don't list every single investigation that we do. Some of them are repetitive; the fact situations are repetitive and so on.

We do make a resumé of the decisions that can be useful for the public, and particularly under PIPEDA, we have almost 400 decisions, I think. Sometimes you'll see the name of the respondent and the complainant, but that's very rare. They're listed on our website so that the public can better understand how we interpret the law. We have fewer decisions that we publish under the Privacy Act, but we're working on that so that, again, citizens know how we look at their complaints in relation to the federal government.

11:45 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

So it's just basically the general area and not the specifics that are reported?

11:45 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

No. They're kind of what lawyers call case summaries. Often they can be a page and a half or two pages long. They explain what the complaint was, what the factors were that we looked at, and what the conclusion was.

11:45 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Thank you.

As you're no doubt aware, this committee is currently examining the issue of allegations of political staff in a minister's office engaging in interference in information from government, both through access to information and through the process of legitimate enquiry. This has been in the public arena fairly substantially recently, especially as it relates to the PMO.

Have you had any concerns regarding the possible exceeding of the legitimate role of the federal government or personnel in regard to the Privacy Act and whether there are actual contraventions of the letter of the law or at least the spirit of the law?

11:45 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

I believe, honourable member, that we did receive a complaint of that nature. The result of the complaint was that the allegation was not founded in terms of the law having been exceeded for political reasons, as I remember.

So I think it's always a concern. We don't have.... There was another case we investigated some years ago where a reporter alleged that his request to the Prime Minister's Office had been jeopardized by the fact that his identity was known. Our investigation revealed that, as I remember, the staff surmised from the type of request it was and that there was no evidence that the identify of this person had been revealed.

11:45 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

So in terms of those cases, we wouldn't have the specific case, but there would just be a summary of what you found. Is that correct?

11:45 a.m.

Privacy Commissioner, Office of the Privacy Commissioner of Canada

11:45 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

In the ones you've mentioned?