Information & Ethics Committee on Oct. 19th, 2010

[Jennifer Stoddart]

I talked about an international trend. I also spoke about two professors, including France Houle at the Université de Montréal, who did some work for us to determine whether the legislation passed in 2000 is now able to target modern personal information protection concerns. That report has just been submitted to us; I talked about it in my presentations. One of the recommendations is discussing the possibility of having a slightly more coercive regime.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

I would now like to ask you a question about Blackberrys. Most public servants, MPs and ministers have a Blackberry. When a device is lost or stolen, we call the service provider who tells us that our information will be purged. There is a certain level of security. When the wrong code is entered, after three tries, we are asked to type Blackberry to open the device. The security level is perhaps not up to par when confidential data are being stored.

One of my colleagues recently lost her device. She was told that the data had been purged but she found it, and she was able to restore the data inside. Is it not worrying to know that there is no more security than that with regard to the storing of all the information on such devices?

[Jennifer Stoddart]

Your question concerns a number of issues. I do not know whether the Blackberry belonging to your colleague was provided by the government, so if it met government standards. In principle, it should be encrypted. From what I have understood, government Blackberrys are encrypted—the ones at my office are. Perhaps it would be a good idea to protect them with a very good password.

This brings me to one of the audits that we conducted, which suggests that the PIN to PIN function is not used. When the PIN to PIN function is used, it seems, according to my experts, that the department or Parliament server is not being used. So, the signal can be intercepted by quite basic equipment.

Finding one's personal information on a Blackberry is not necessarily bad, to the extent that no one had access to it because it is protected by a password.

[Ève-Mary Thaï Thi Lac, Bloc, Saint-Hyacinthe—Bagot, QC]

In your report, you also wrote that government computers are often given to organizations. In news reports, it was mentioned that some data had been erased, but that it was able to be recovered by the organizations receiving those computers.

Following your investigation, what changes will be made to ensure that such data will not be recoverable once they have been erased?

[Jennifer Stoddart]

Thank you for your question. The agencies in question noted their inability to erase the information at the workshop, since the workshop was not really set up to erase personal information. We will do a follow up in two years' time.

[The Chair, Liberal, Shawn Murphy]

Thank you, Ms. Thi Lac.

Mr. Calandra, you have five minutes.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

Thank you, Mr. Chair.

Thank you, Commissioner.

It's interesting to see.... Brian Patterson, I have to admit, is a constituent of mine, and to be honest with you, I didn't even know he could turn on a computer, let alone access a database, which he certainly has no access to in my office. But I suppose that in the confines of parliamentary privilege and how the Liberals have comported themselves on a number of issues, throwing sleaze around is something that happens from time to time at a committee like this.

I noticed that in your report you mentioned--I'll quote you--with respect to the Olympics that you “came away convinced that the Vancouver Olympic Games provided a valuable lesson in balancing security and privacy rights at mega-events--lessons that could be refined and applied again at future national or international gatherings on Canadian soil”.

Of course, I think we are all proud of the Olympics and the type of year we've had with respect to holding international events. I'm wondering if you could say, in comparison to other jurisdictions, whether Canada has become a leader in balancing privacy and security at the same time.

[Jennifer Stoddart]

I think Canada is well respected for its balancing of these two rights. We have a very thorough process. It's not in all countries, for example, that things like the airport scanner, to take that particular one, are referred to the Office of the Privacy Commissioner for a privacy evaluation. I think that has attracted a certain amount of attention. I know that on the level of scholarship, there are a couple of international scholars who are interested in working with us on how to balance the principles of privacy protection with national security imperatives.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

I also want to just follow up on something that Madame Thi Lac had mentioned with respect to computers and data.

Are there actually rules with respect to how these computers--or any data, for that matter--are supposed to be cleaned? In your investigation, did you find that departments aren't actually following the rules? Is that one of the reasons...? Should we be tightening up? Should we be perhaps considering tighter rules or re-educating the public service with respect to how we do this?

[Jennifer Stoddart]

Well, yes, one wonders. The rules have been there for a long time. In fact, 10 years ago, the commissioner who preceded me, Bruce Phillips, did an investigation of this kind and found that there were an enormous number of computers that were not being wiped clean.

My take on this is that at the end of the 1990s we were all just starting to work with computers and maybe we didn't realize that everything is indelible unless it's specially wiped and so on. But we thought, for interest, that we would follow up 10 years later to find out what was happening.

In our sample, 40% of the computers had not been completely wiped. There was still personal information on them--in fact, national security information--in spite of the clear directive that has been around for more than 10 years, and in spite of, I would say, increasing popular personal individual knowledge of what happens on the computers we all work with, whether they're little BlackBerrys or much more powerful ones.

This was a bit of a surprise to us. It's not that the rules aren't there, but I guess busy people forget that, or the job's half done. That's another audit we'll be following up on in two years.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

I come from the insurance industry. I was an insurance broker. I remember that the introduction of PIPEDA was something that was very confusing for us in the early years. There is still a lot of confusion, I think, with respect to it, certainly in the industry that I was in. You found some organizations that were very aggressive with respect to how they treated personal information and to signing off on the information that was provided.

Is there still some room for education? I know the answer is going to be yes: there has to be some room for educating private business with respect to the collection of information and how important it is, and perhaps clarifying and helping them understand the importance that our government places on the privacy of people. Do you have any suggestions on how we can actually educate a bit better in the private sector?

[Jennifer Stoddart]

Yes. In fact, educating small and medium-sized businesses would be an objective for the next three years--if I continue on for three years--because we realize, partly because of the work of these two university professors, that big business, like the big insurance companies, the big banks, and so on, are following the rules pretty well. They're pretty sophisticated. We rarely have serious complaints against them now, and if we do, they're quite rapidly settled.

The issue with small and medium-sized businesses is that this is seen as an extra financial burden—and it probably is—for them, as just another thing they have to do. We're working on a program, particularly out of Toronto, where a lot of Canadian business is centred, to take some of the tools that have been developed by big business and, with them, try to adapt them. So these would be tools that small and medium-sized businesses could access free of charge through our office so that they don't have to go out and spend $200 or $300--sorry, $3,000--on a custom-made.... There should be something that is reasonably adapted, that can be scaled down from the bigger business experience.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Calandra.

Mr. Bill Siksay, for five minutes. I'm having trouble with that name; I will get it, Mr. Siksay.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You will get it yet, Mr. Chair. It's like “apartment 6A”; it's not “apartment 5B”.

[Some hon. members]

Oh, oh!

[The Chair, Liberal, Shawn Murphy]

It's that “k” in there that's driving me crazy.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I know: the mysteries of the Anglo tongue.

Thank you, Mr. Chair.

Commissioner, I wanted to come back to your investigation report on the situation at Veterans Affairs. You made some specific recommendations to the department, some for immediate steps. I know that wasn't so long ago. Have you heard back from the department on that? Is there any follow-up yet in terms of what's in place?

[Jennifer Stoddart]

Not that I'm aware of, no.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

In some of your reports, you negotiate. I know that in PIPEDA, you work with the offender—that's not quite the right word—or the entity to come up with recommendations in a process. Is that true with the Privacy Act too? Did you work with Veterans Affairs on developing these recommendations and have they signed off on them by the time you make your report? Or is this a different process?

[Jennifer Stoddart]

The recommendations are shown to them. They have a chance to comment on them, to make factual corrections to the report and so on. Whether we negotiate, as you say, or try to arrive at a consensus, depends on the type of issue we have.

Here we have an issue where it seems there were multiple illegitimate accesses to somebody's personal information, so it's not something that you can really negotiate on, going backwards. But forward, I didn't hear that there was any objection by the department or the officials to any of the recommendations that we made going forward, nor indeed to an audit.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

The first recommendation was, “Take immediate steps to develop an enhanced privacy policy framework...”. What is “immediate?” When would you think something like that should be in place, given the seriousness of this situation?

[Jennifer Stoddart]

For taking “immediate steps”, I would say in the days and weeks that follow. If this is a widespread issue, it's pretty critical.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

So we're within that timeframe now in terms of when you released your report.

[Jennifer Stoddart]

Exactly.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Commissioner, just in terms of the Google Street View issue, when the committee was doing work on this—and it was some time ago now—we heard from another company, Canpages, that was using a similar process. Do you know if there are similar issues in terms of the collection of other data from other companies that are using a similar process? Have you looked into that?