Evidence of meeting #2 for Access to Information, Privacy and Ethics in the 40th Parliament, 3rd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was 100000.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Elizabeth Denham  Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada
Tom Pulcine  Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

11:15 a.m.

Liberal

The Chair Liberal Paul Szabo

This is the second meeting of the Standing Committee on Access to Information, Privacy and Ethics.

Our orders of the day include two items. The first is committee business, with a report from the subcommittee on agenda and procedure. The second is to address a couple of matters on supplementary estimates (C).

Our witnesses are already here. I've had some discussions and there is an agreement that we will deal with supplementary estimates (C) first. We should be able to dispose of that within a reasonable time.

I would like to welcome Elizabeth Denham, who is the assistant privacy commissioner, and Tom Pulcine, who is director general and chief financial officer, corporate services branch.

I wonder if you would please outline for the committee the nature of the supplementary estimates (C) for privacy, and any other statements you care to make at this time. Then we'll see if the committee has some questions. So please proceed.

11:15 a.m.

Elizabeth Denham Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Merci.

Good morning, Chair, and members of the committee.

Good morning, Mr. Chair and members of the committee.

It's very nice to be here again and see some familiar faces. As you've just said, I am accompanied by Tom Pulcine, our director general, corporate services, as well as Steven Johnston, our senior security and technology advisor. Steven is available in case we get into some IT technicalities that are well beyond my knowledge.

I understand that we're here to discuss supplementary estimates (C) relating to the OPC's oversight role in relation to anti-spam legislation, referred to in the last session as Bill C-27, and more commonly as the Electronic Commerce Protection Act or ECPA.

I thought it might be worthwhile to take a couple of minutes to put our role regarding that legislation in context. Would that be helpful, Mr. Chair?

I'm afraid that with the somewhat short notice our office didn't have time to write and translate a statement, and I confess that I was much more up to speed on the content of this legislation when I appeared before the House industry committee in June. As of this morning, this legislation has not been reintroduced in either House, but I am speaking now as though the legislation will be the same as that passed by the House last November.

As many of you know, the overarching purpose of ECPA is to combat spam in order to provide for a safer Internet. Spam is a serious problem that has a significant impact on the economy. I should point out that Canada is currently the only G7 country without such legislation. Once passed, the legislation would involve a triad of federal agencies in oversight: the CRTC, the Competition Bureau, and the Office of the Privacy Commissioner.

Our role will be to investigate the unauthorized collection and use of personal information from e-mail addresses through a variety of different techniques: harvesting, dictionary attacks, and malware or spyware. I'll be happy to talk about these later if there is interest.

The legislation doesn't change our existing enforcement powers, and we don't expect a significant increase in new complaints to our office under this law. However, we need to gear up incrementally. We need to explain this new law to our stakeholders and the public, and undertake compliance education. The investigations themselves are likely to involve increased technical complexity, as well as collaboration with domestic and international enforcement bodies, and a need for legal enforcement action in some cases.

The legislation also imported some amendments to PIPEDA that are familiar to many members of this committee. Number one is to give the commissioner discretion to decline to investigate a complaint, discontinue a complaint or refer it elsewhere, and allow for collaboration with and the exchange of information with provincial and foreign counterparts who oversee and enforce laws that are similar to PIPEDA. These are general amendments to PIPEDA and would therefore apply to all of our activities, not just those activities related to spam.

In this fiscal year of 2009-10 we have estimated $100,000 in operating costs, anticipating that this bill will receive royal assent in this fiscal year. That amount relates to communication, education, and awareness activities.

Canadians need to be aware that our office will take complaints related to spam through dictionary attacks, spyware, or other methods. We need to prepare for public inquiries and inquiries from business and other government agencies. So we've been busy drafting materials and have developed internal training materials for our own staff. We've also really ramped up our technical expertise that will be needed for investigations dealing with spyware and malware under ECPA. And we've invested in software for these online investigations.

Perhaps that's enough to give you some context for our request. I'm happy to answer any questions.

Merci.

11:15 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you kindly, Ms. Denham.

We'll take questions from members.

Mr. Easter, please.

11:15 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Thank you. Thank you, folks, for coming.

On the Electronic Commerce Protection Act, virtually no legislation has been introduced yet. We've been back pretty near two weeks. The government took months to recalibrate, and all we seem to be doing is having opposition days and very little else.

How important is it that it be reintroduced? Are you expecting any changes in terms of its being reintroduced, compared to what it was? Then I have a couple of other questions.

11:20 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We think that spam is a very serious issue. It's much more than a nuisance. Many of you are probably familiar with the kind of spam that lands in your inbox. What spam does is it actually undermines confidence in electronic commerce. On the really insidious side of spam, it's a method of delivery of spyware, which can actually compromise computer systems and of course personal information.

We think it's very important legislation, and the commissioner has been supportive of the passage of this legislation for some time.

11:20 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

I actually can attest to the problem of spyware on my portable computer. When it's on the security system here, there's no problem. But I came back one time and they had to completely wipe everything and start over—and it was just on our own system at home.

You said that we are the only G7 country without legislation. How many years behind other countries are we in terms of not getting our act together?

11:20 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

I know this government has been looking at spam since as long ago I believe as three or four years, when the anti-spam task force worked on some pretty significant reports. As I say, I think there's some concern about Canada's becoming a haven for spam. We are behind, and our commissioner is very supportive of this legislation. It's critical.

Our director general of corporate services told me this morning that 97% of the e-mail that actually hits our network at the Office of the Privacy Commissioner is spam, so it's a significant issue for resources in our economy.

11:20 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

I understand that, and I understand the implications and the need. You're saying the government is looking at it. They've been looking at crime bills now for about four years as well, but very few of them got through because we've been prorogued twice.

They look at a lot of things. They've been looking at a lot of things. We hear the same thing in another committee—I'm on the agriculture committee. They're going to do something, but they never get it done. They're good at propaganda.

So my question is, how many years are we behind other countries in terms of getting this done?

11:20 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

I don't have that information. I can certainly go back and provide it to the committee.

11:20 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Okay.

You're saying it undermines confidence in electronic commerce, being banking and so on. Are people afraid of people being able to tap into their bank accounts? Is that what you're saying, basically? Is any of that happening? Is there any reason to be really concerned on the electronic commerce side? I think most of us now do banking by the Internet, pay bills by the Internet, etc. How do you deal with concerns in that area now without the legislation? Would the legislation make a difference in that area, or really, is there any need to be greatly concerned? Have many problems gone astray in that area?

11:20 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

I can tell you that a target for spam and malware are the log-in details for someone's financial account.

11:25 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Okay.

I want to come back to the fact that the commissioner feels strongly that this legislation has to be reintroduced. I think you indicated that you expected that the costs in the initial year would be around $100,000. That's not a whole lot of money. Is there anything in the budget to accommodate that? Do you see that the freezing of salaries and operations within budgets are going to have any impact in terms of your ability to do your job?

11:25 a.m.

Tom Pulcine Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

We don't expect that the freeze in the operating budget will have an impact on the resources of this legislation. Our understanding, as it relates to the freeze in the operating budget, is that it does not affect any new initiatives. If this legislation was to pass and resources were to be allocated through the estimates process, whether it be these supplementary estimates or next year's main estimates or supplementary estimates within the next fiscal year, then we would expect that would happen.

11:25 a.m.

Liberal

Wayne Easter Liberal Malpeque, PE

Thank you.

11:25 a.m.

Liberal

The Chair Liberal Paul Szabo

Thank you.

Madam Freeman, s'il vous plaît. Tu as la parole.

11:25 a.m.

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

I am sorry, but I was late for Mrs. Denham's presentation. Welcome to you two, and thank you for being with us this morning.

I would like to follow up with Mr. Easter's question about the $100,000 you are requesting. Your budget for the current year ending on March 31 stands at $34,000,000. In this supplementary budget, you are requesting $100,000. Is that right?

11:25 a.m.

Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

Tom Pulcine

No, it is $20,000.

11:25 a.m.

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

Would it not be $20 million?

11:25 a.m.

Director General and Chief Financial Officer, Corporate Services Branch, Office of the Privacy Commissioner of Canada

Tom Pulcine

Right. It is $20 million.

11:25 a.m.

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

As a matter a fact, we have here both the information and the privacy commissioners. You are getting $20 million, if we break down the figure, and you are requesting $100,000 more to implement this legislation on commercial e-mails. Is that right?

So, explain this to me. Has this $100,000 already been spent or do you really need it between now and the end of the current fiscal year?

11:25 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We feel that we've already spent $100,000 in this fiscal year in preparing for the Electronic Commerce Protection Act. It's been spent in diverting some internal resources away from other projects to prepare public education materials to turn our minds to the kinds of technical investigations that we might be doing, etc. So we have diverted resources and spent about that amount of money in preparation, believing that the bill was going to go ahead.

11:25 a.m.

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

If I get it right, the $100,000 you are requesting has already been spent for activities against commercial e-mails. In which area did you cut in order to spend this $100,000 somewhere else?

11:25 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

I could tell you that the $100,000 has mostly been spent in our communications branch and our research and education budget, which is where our technical analysts reside.

11:25 a.m.

Bloc

Carole Freeman Bloc Châteauguay—Saint-Constant, QC

Is that where the $100,000 is coming from? You said earlier that you made cuts in some areas. So, you made cuts in training in order to be able to invest $100,000 in the fight against spam. Am I right?

11:25 a.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Elizabeth Denham

We've diverted some internal resources from other projects, some of our policy work, in order to prepare the materials and to prepare our inquiry staff for the kinds of questions that we expect to receive from the public.