Evidence of meeting #2 for Access to Information, Privacy and Ethics in the 40th Parliament, 3rd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was 100000.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Elizabeth Denham  Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada
Tom Pulcine  Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

11:35 a.m.

NDP

Alex Atamanenko NDP British Columbia Southern Interior, BC

Thank you. If you could, that would be great.

Those are the only questions I have, Chair.

11:35 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you, Mr. Atamanenko.

We will be having the commissioner and other officials here to deal with a broad range of issues, including those that you've just raised, so thank you.

Ms. Davidson, please.

11:35 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Thanks very much, Mr. Chair.

Thank you very much for being here with us this morning and for going through these supplementary estimates.

In your opening remarks, Ms. Denham, you said that the Privacy Commissioner is requesting $100,000 to implement and enforce legislation concerning unsolicited commercial e-mail and related online threats. In the answers you've already given here this morning, we've certainly understood what legislation we're speaking of. Certainly, it was good to hear the parties' support for that legislation. I expect when it is introduced before too long there will definitely be all-party support for it, and it will be expedited through the process. So that's encouraging to hear.

Could you tell us how you came to the $100,000 figure?

11:40 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

Of the $100,000 figure, approximately $80,000 is for communication, outreach education, and staff time, and then I believe 20% is for corporate services.

It's an estimate of what we needed to undertake those initial activities, which are about advising Canadians of what this new statute means and what our mandate means to Canadians.

11:40 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

I think you also stated that Canada was the only G7 country without legislation in place at this time, and that we also had been looking at it as a government for three to four years and had the legislation before the House and on to the Senate. You had alluded to other countries and not knowing the dates of when they may have enacted it, but would it be within the last two to three years, or have they had legislation in place for much longer than that? Do you know?

11:40 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

The CAN-SPAM legislation, which is the U.S. legislation, was introduced in 2003, if that's helpful. I can follow up with Australia, New Zealand, and some of the European countries.

11:40 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

That would be interesting to know, because, as I said, this government has been looking at it for three to four years, and I would be interested to know whether or not prior governments had even looked at the issue.

Can you elaborate on why the need is most urgent in this area? Why do you need that funding? I know you've talked about money that's already been appropriated or expended through existing budgets, but what's the urgency of this?

11:40 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

Because of the technical nature of spam and spyware and dictionary attacks and e-mail harvesting, which are the areas our office will have to have the mandate to oversee, there's a lot of work to get ready for that: educating our inquiry staff, who are at the front end, as they take the calls from the public; getting our investigative staff up to speed on this legislation.

Our technical analysts, who reside within our research branch, are going to have to be ready to take on the front-end work and also advise our investigators who may be on the ground investigating our complaints about spyware, for example. So it's technical issues. We have to be ready for it. We have to be responsible and ready to hit the ground running when the act is in force.

11:40 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Thank you.

Are any of those initiatives ranked higher than the others?

11:40 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We felt that the most important readiness activity was developing public education materials and internal fact sheets and training programs for our front-line staff, because they need to understand this area of the law and these kinds of risks and attacks on computer systems.

11:40 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

I stand to be corrected, but I believe you said the $100,000 was to implement and enforce the legislation. How would you do that? How would you implement and enforce it? “Enforce” is a pretty strong word, so what would be the enforcement end of it?

11:40 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

Under the legislation, under ECPA, our office doesn't get any new enforcement powers; it doesn't change the way we're structured or how we approach investigations, but individuals can file complaints with our office about unsolicited commercial e-mail, about the unauthorized use of personal information. Of course, an e-mail address is personal information under PIPEDA, so we would be investigating that.

As well, there is education for businesses, education for individuals. But unlike our federal partners, who are going to share enforcement of this legislation, we don't have order-making power; we don't have administrative monetary penalties, for example. So the CRTC and the Competition Bureau, who are going to assist in the enforcement of anti-spam, have stronger enforcement powers. All we can do is make recommendations. We have to turn to the Federal Court for enforcement.

11:45 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

What are the staffing implications of this? Are they huge?

11:45 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

No. Again we have to see how this all plays out over the next few years, but we expect that within the first two to three years we'll need a handful of new staff. We don't expect to receive the majority of the complaints about spam and spyware. We expect those to go to our other triad partners.

We do expect we're going to need a couple of new investigators, another technology resource, and it's going to have implications for our policy branch and also our legal branch.

11:45 a.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Thank you very much.

11:45 a.m.

Liberal

The Chair Liberal Paul Szabo

Ms. Foote, please.

11:45 a.m.

Liberal

Judy Foote Liberal Random—Burin—St. George's, NL

Thank you.

Thank you for joining us this morning.

In my questions, I want to pick up where Madam Freeman left off. I want to get some sense of what it will mean to your office if you don't get the $100,000.

11:45 a.m.

Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

Tom Pulcine

The $100,000, relatively speaking, is a very small number. To be very clear and honest, it probably would have no impact at this late stage of the fiscal year.

In essence, the authority we have right now is the $20 million or thereabouts, and that's the amount we're living within, so this late in the year, even if the legislation were reintroduced and passed, it's highly unlikely they would actually spend that amount of money.

It's very much a case, as I said already, where there's a bit of a catch-22 in terms of where the supplementary estimates process is relative to where the legislation last left off. If this legislation had been passed sometime late in the calendar year, let's say, then it's highly likely that we would have been able to effectively spend the additional resources.

11:45 a.m.

Liberal

Judy Foote Liberal Random—Burin—St. George's, NL

So do you anticipate, then, that you will need additional money down the road to implement this legislation?

11:45 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We have a plan whereby we're going to build incrementally the kinds of resources we need. There will be a lag time between royal assent and the implementation of the legislation, when Canadians actually start filing their complaints with our office. We expect that there will be a lag time.

As I said, we expect a handful of new staff over the next couple of years. Then, depending on the level of business we get under anti-spam legislation, we may have to come back to Parliament for additional resources. But we need to actually have the experience on the ground. It's going to take a couple of years to figure that out.

11:45 a.m.

Liberal

Judy Foote Liberal Random—Burin—St. George's, NL

You say that other countries are ahead of us with respect to this type of legislation. Have you looked at what has happened in other countries in regard to the overall cost?

11:45 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We haven't looked at that because, again, our role in enforcing anti-spam legislation is really quite narrow. The Competition Bureau and the CRTC actually have a bigger role in this. Our role is very small and is related to the unauthorized collection and use of personal information such as e-mail addresses.

11:45 a.m.

Liberal

Judy Foote Liberal Random—Burin—St. George's, NL

It always raises a question with me when I hear that you're one of several entities involved in enforcing a particular piece of legislation. Are you working in isolation from each other? Do you not have the discussion? Do you not come together and find a way or have a discussion about what this cost may be down the road or about who has what responsibility for enforcing this legislation?

For me, when you say you're a small component of it, I have a question: do you not have the discussion of how you fit into the bigger picture?

11:45 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We have had that discussion. Those discussions have been led by Industry Canada, really, and plans are afoot to have a spam reporting centre, which is going to be a coordinating agency that takes in the complaints and refers those complaints to the appropriate agency to deal with the nature of the issue at hand.

So yes, there indeed will be coordination, and part of ECPA is to give these three agencies the authority and the ability to share information so they can collaborate and cooperate. It's a one-window approach, from the public's point of view, and there will be definitely collaboration and cooperation. That's one of the points of ECPA: to give us the ability to share information between these entities.

11:50 a.m.

Liberal

Judy Foote Liberal Random—Burin—St. George's, NL

Where would the spam reporting centre operate out of? Would it operate out of the Department of Industry or some other department?