Information & Ethics Committee on Oct. 19th, 2010

[Jennifer Stoddart]

Yes, our experiences have been positive. The panel has brought together, in a very innovative and positive way, parliamentarians, Treasury Board officials, and us as the organization that requests the money. We talk to Treasury Board beforehand, so all the budgetary requests we make have the support of Treasury Board. We answer the questions as to why we need this money. In our case, we have the resources we asked for.

[The Chair, Liberal, Shawn Murphy]

From your testimony here today, it seems to me that your office is embarking on some relatively major initiatives--the DVA issue, the Google issue, and the Facebook issue, among others. In your opinion, do you presently have sufficient resources to carry out the mandate you've been given by Parliament?

[Jennifer Stoddart]

I think so at the present time. I know that we're under economic constraints. One of the things I'd like to do in the future is continue to try to find ways to work more efficiently, perhaps by the use of things such as online complaints and increasingly turning to the Internet as a way of interfacing with Canadians.

What would be helpful as an agent of Parliament, I think--and as you know, for certain things we're in a different world than government ministries--would be some flexibility in the administration of the budget, which we don't have. This is something that we've recently realized is a challenge. It is not necessarily to get a new budget or to overrun our budget, but simply to administer the different budgetary posts as we choose.

[The Chair, Liberal, Shawn Murphy]

In your opinion, Ms. Stoddart, in the fulfilling of your office's mandate, are you receiving cooperation from all departments and agencies within the Government of Canada?

[Jennifer Stoddart]

Yes, I think cooperation has been very good. I'm not sure that people are really happy to see us coming. I think that if there were a popularity contest, certainly we wouldn't win it.

There has been cooperation. There is respect for the functions of the office and also an understanding by departmental officials that what we do is important, even though they're not always happy to see us and we raise uncomfortable questions.

[The Chair, Liberal, Shawn Murphy]

As I have indicated, we've concluded the second round.

We're going to go to the third round now. You will have five minutes each.

We're going to start with Ms. Bennett.

Ms. Bennett, you have five minutes.

[Carolyn Bennett, Liberal, St. Paul's, ON]

Somehow it makes it easier for a commissioner if the departments actually have a culture of divulging when there's been a mistake. We've learned from the airline industry that you don't lose your licence for making a mistake; you lose your licence for failing to report a mistake.

I think in the ongoing interest of the privacy of Canadians, departments need to feel comfortable reporting a possible or real breach in the data, such that it turns into a learning culture, where you could tighten this up because the department says, whoops, this happened.

Yet we all know that within departments there's a sort of risk-averse culture. If you've made a mistake or almost made a mistake, there's a sort of gotcha feeling or a reluctance to admit that there was a mistake.

Do you think we're getting there, that departments are feeling more comfortable reporting a possible breach or a real breach rather than waiting until it is caught or comes from a complaint-based system?

[Jennifer Stoddart]

Yes, that's a very important question. I think that on some page of this annual report, we report on a growing trend by departments to report privacy problems to us, departments that aren't legally obliged to, including losses and breaches and so on, in the hope of getting some help with this.

Increasingly we're trying to focus on a collaborative, preventive role, because you know, if people are going to be punished, they don't come forward. The issue is how to not keep repeating the same problems, or at least to make sure that they don't happen again in exactly the same way. This is a trend and I'm very happy about that.

[Carolyn Bennett, Liberal, St. Paul's, ON]

When asked about resources, you said that you thought you had sufficient resources to do the audit within Veterans Affairs. In terms of the privacy impact assessments, It looks like you've had a 60% jump in submissions. Do you think you have enough resources to do these in a timely fashion?

We congratulate you on getting rid of the backlog, which is the complaints-based system, but do you have the tools to do it proactively with audits and impact assessments? How do you decide which would be the most important ones to do, given the limited resources?

Mr. Chair, in terms of this committee, will we write a report that would allow the commissioner more flexibility in terms of the way she administers her budget? Is it possible for us to do that, Mr. Chair?

[The Chair, Liberal, Shawn Murphy]

Definitely: we can write any report we want, and that report would go to government, Ms. Bennett. Perhaps we can ask the commissioner to elaborate on that. There are probably results of some of the problems that this office had before Ms. Stoddart became the commissioner. This particular office has had problems in the past, as we're all aware, and there may be some constraints as a result of previous issues.

Am I right in that, Ms. Stoddart?

[Jennifer Stoddart]

No. These are not constraints because of previous issues. That was what was happening in the first three years of my mandate. We got back our full powers and full confidence.

Perhaps, Mr. Chair, I could answer the question of the honourable member: how do we then choose with limited resources? We look at our privacy impact assessments and choose the ones that, after a first initial examination, seem to us to be the ones that put Canadians' personal information most at risk.

[Carolyn Bennett, Liberal, St. Paul's, ON]

In some of the legislation that died on the order paper, you had some concerns. Have you been consulted on what was the previous Bill C-46, Bill C-47...? Do you anticipate that your concerns will be dealt with if those bills are tabled again?

[Jennifer Stoddart]

They have not been tabled as such, for which I am very happy. We did in fact consult extensively ourselves and then wrote a preliminary letter to the Minister of Public Safety last fall. Some of the content of those bills or the purpose of the bills is now enshrined in, I believe, Bill C-29, and certainly that's an improvement on what we saw last summer.

[Carolyn Bennett, Liberal, St. Paul's, ON]

But do you routinely see bills beforehand for a privacy assessment?

[Jennifer Stoddart]

No, we don't.

[Carolyn Bennett, Liberal, St. Paul's, ON]

So do they table things that could be a problem and then find out afterwards?

[Jennifer Stoddart]

Yes. But in some cases, when it is a matter that comes under our particular jurisdiction, often there is informal consultation between ourselves and department officials. But we don't see the legislation per se before it's tabled.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Ms. Bennett.

Mr. Albrecht, five minutes.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

Thank you, Mr. Chair.

Thank you, Commissioner, for being here today.

I'm a recent appointee to this committee, so I don't have the long institutional memory that many of my colleagues here have. I just want to follow up a bit on the training or the provisions for members of the community to know what their obligations are.

On page 11 of your report, relating to the mortgage brokers, you indicate:

The Mortgage Brokers, Lenders and Administrators Act, 2006 requires mortgage brokers and agents to undertake specific training concerning the provision of mortgages. While we found that brokers and agents had undertaken this mortgage training, no agents from the mortgage broker companies that we audited had been provided with formal and ongoing training under company-specific privacy practices, or their responsibilities under PIPEDA.

I think it's quite possible and probable that many of the employees or individual brokers or agents had actually acted in ignorance and may not have been aware that there actually had been a privacy breach.

Now, I'm sure that most departments have strict safeguards to ensure that personal information is secure and that their employees are well trained in their efforts to protect their documents. I understand you said a few minutes ago that in your next three years you're going to focus more on the training aspect, especially related to private agencies, but my question is, what kind of current training does your department do beyond what private companies like this, or even individual departments in government, would provide to their own employees?

The second part of that question is this: if you could guess, what percentage of the breaches that occur would you think are simply human error, or ignorance, as opposed to wilful ignoring of the guidelines?

[Jennifer Stoddart]

First of all, what do we do for businesses already? We have extensive material on our website. Increasingly, we use our website, because it can be accessed by Canadians across Canada. We have just updated our tool kit for small business in consultation with the small business communities. As I've said, we hope to continue that in the future, using some of the material borrowed from the experiences of larger companies that can be adapted.

We consult with various representatives of the small business community regularly, and if they say they need x number of information sheets for their kits at a conference, we are happy to provide them with those. We have some that are done particularly for businesses.

This might seem a little frivolous, but we have worked on a series of cartoons. I think we have about 20 different cartoons now that are very useful for public education. It's hard to get the attention of the business person who's worrying about their balance sheet at the end of the month, so maybe somebody in a presentation in a local community can use one of our cartoons, and it might get their attention. Then maybe they'll go on and listen to the short message and explore this by themselves.

Those are some of the things we want to do.

We're also cooperating with the provincial commissioners across the country to provide them with templates for personal information in areas where either we have jurisdiction or sometimes there's a kind of overlapping jurisdiction. Or they can serve as the distribution point, in a collegial fashion, for materials and messages about small business if we have a jurisdiction in a province, for example, like Saskatchewan. So we do things like that.

Finally, what percentage of data breaches are human error? I would say probably between 40% and 60%. It depends on what sample you look at. It's not all about thieves and hacking into computers and so on. Often it's just employees who make human errors, as we all do, and now the errors are amplified by the technology, so it's in fact more stressing, I think, not to make an error now.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

Do I have any time left, Mr. Chairman?

[The Chair, Liberal, Shawn Murphy]

Go ahead, Mr. Albrecht.

[Harold Albrecht, Conservative, Kitchener—Conestoga, ON]

In relation to your international investment of time and energy, would you have a rough idea as to what percentage of your department's resources are invested in developing international policy to address the issues you've mentioned in your statement about the resolution to see privacy considerations becoming embedded in the design?

Would you have a rough idea as to what percentage would be committed to that international component? Because the computer world is a borderless world, as we know.

[Jennifer Stoddart]

I guess we've never looked at it that way, but maybe it's 10%. I'm just saying.... I have the director of finance here, but I don't think even he has ever calculated that.

We do it because, once again, we think we can be more effective. If it's Canada alone on this technology, well, you know.... If we have a strategic alliance, we'll have much more effect.

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Albrecht.

Ms. Freeman, you have five minutes.