Information & Ethics Committee on Oct. 19th, 2010

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair.

Welcome back, Commissioner Stoddart.

I'm glad to hear you're considering another stint at the job. I want to remind you that time flies when you're having fun, so seven years might not be too long. But anyway, I do appreciate the work that you've done in this position in this first appointment.

I also want to recognize that your colleague, your former assistant commissioner, Ms. Denham, has gone to British Columbia to be the privacy and information commissioner there. I'm pleased for her that she gets to stay on the coast now, while I have to fly back and forth, but we're glad that she's taken up that important position there.

[Jennifer Stoddart]

Yes, and we miss her.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I'm sure you do.

Commissioner, I want to go back to the situation at Veterans Affairs. I know that all of us are outraged and horrified by what we've learned has been happening there recently and have some frustration, as I know you do, about that situation.

I understand that your original report was a specific investigation into a complaint made by a particular individual. Now you say you're doing an audit of the practices with regard to privacy in Veterans Affairs. Is there some kind of hierarchy of your investigations? Is it an investigation and then an audit? Is there something beyond an audit that you can do? Do you have various descriptors of the kinds of tools you would use to get to the bottom of something?

[Jennifer Stoddart]

We have investigations under the act, and they can be broadened into systemic investigations. This tends to be inquiries into a particular set of facts around a particular individual or a series of individuals, looking maybe at patterns and practices, but always related to a specific event.

An audit is I think what we usually understand by its name. It's a general sampling, according to the best scientific principles of representivity, into the practices and the observances of personal information protection in an organization.

We do both investigations, mostly because people complain to us about something. Sometimes we initiate our own investigations, like the Google Wi-Fi one.

What I've announced is that I thought the best tool for Veterans Affairs, given what we were learning, was to do an audit. So that would be a department-wide audit, but only on personal information protection measures.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You've said publicly that you're concerned that this may be happening elsewhere, but you've said again today that you haven't seen any evidence of that. Could a systemic investigation be broad? Could it be across the government, across multiple departments, across the whole government? Do you see that kind of investigation? Or are your systemic investigations more compact than that? What would it take for you to move to a broader consideration of what's happening across government?

[Jennifer Stoddart]

It would be a major, major, major operation; I would need quite a few mandates, I think, to accompany that. Our audits usually take a year, although I hope this one could be done faster, and that's in a relatively small department. It's a very big operation.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Do you have the resources to do the kind of audit that you've undertaken now?

[Jennifer Stoddart]

Now, in Veterans Affairs, yes, I believe we do.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I want to go the Google report that you released today. I have to say that as a member of this committee I'm concerned, given our initial investigation into Google Street View.

I don't think any of us had any sense that this was anything broader than a street photographing imaging operation that would put up images of what your street looked like and made them accessible through Google Street View. In any of its public discussions of Google Street View, have you seen any indication that Google was collecting other data or was doing anything other than taking photographs and putting them in this particular application on the Internet?

[Jennifer Stoddart]

No. Nobody that I heard of in the international data protection or IT community was talking about what happened. What was happening was unbeknownst to all of us until this spring. One of the länders'--they're like the German provinces--data protection supervisors, who have jurisdiction over a lot of the private sector in Germany, started a discussion with Google that quickly became public because they suspected that Google was scooping up personal information.

As I remember the newspaper reports, Google initially denied it, in retrospect because they did not know themselves that they were scooping up personal information. That's how they store...and that's just in April-May of this year.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Is it your understanding--I'm a techno-peasant, so I'm struggling here--that the process they used to gather the street images, the photographic images, somehow required the use of Wi-Fi networks that would put them in contact with this personal information that they had also gathered? Are the two somehow...or is it required, somehow, that it was part of the operation to do an appropriate street imaging and mapping operation?

[Jennifer Stoddart]

I'm not a huge personal specialist in this, but I understood that the initial operation was to do a street mapping. Then they were interested in picking up Wi-Fi transmission points for the development of other services, geo-location services. But they didn't understand--because of internal, I'd say, organizational problems--that in doing that they also got the personal information that was unencrypted and not password-protected.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Was Google public about their plan to pick up Wi-Fi transmission points as part of this process? Do you have any indication anywhere that they were public about that part of the process?

[Jennifer Stoddart]

I know that at the office.... In fact, Assistant Commissioner Elizabeth Denham, who was responsible for this area, said they had a plan to go on and use geo-location data, which is another field to be exploited by those who are in that business, but nobody had an idea that it involved collecting unprotected information as well.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay.

Now, in the report you released today, I notice that at one point you say that your officials undertook a site visit to their operation in Mountain View, California, I believe, back in July. There's a sentence here I wanted to ask you about. It says, “Although our technicians reviewed the payload data, no Google representatives were available in Mountain View to answer our questions.” I think it goes on to say that they did respond by letter to general questions you sent.

Did you get cooperation from Google in terms of your investigation? Or is this an indication that Google wasn't cooperative or wasn't helpful to the work when you were trying to investigate this situation?

[The Chair, Liberal, Shawn Murphy]

Mr. Siksay, your time is up.

I would ask the witness to answer, please.

[Jennifer Stoddart]

Okay. I'll say that overall they were cooperative, but that maybe there were a few sticky points.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Siksay.

Mr. Poilievre, seven minutes.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

Thank you very much.

Congratulations on your reappointment and thank you very much for being with us today.

Our government shares your profound concerns with the unauthorized sharing of information by public servants at the Department of Veterans Affairs, and we're very thankful for the work that you've done to investigate it. As a government, we are committed to implementing the recommendations you have summarized here.

Can you tell me what your next steps are on this particular file?

[Jennifer Stoddart]

We're doing what's called “scoping the audit”, which involves basically setting up a work plan. This may take a couple of months--Veterans Affairs has offices not only in Prince Edward Island, but also here in Ottawa and across the country--for deciding how we are going to do the work, whether we'll have to contract it out, whether it will be in-house staff that will do it, just how big the sample size will be, and so on. I'd say there's a good few months of planning.

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

When that planning is complete, to what end will you be acting?

[Jennifer Stoddart]

We'll be acting to see how this situation that was uncovered in our investigation--and that we and other people read about in media reports of other veterans who dealt with the department--actually came to be. Were there any policies or were they just not followed? How widespread were the problems and what is being done to fix them? What further steps should the department take to make sure that this can't happen again?

[Pierre Poilievre, Conservative, Nepean—Carleton, ON]

It seems that the problem goes back to somewhere between 2004 and 2006. We've heard public reports of ministers in the previous government who received the same briefings that have been reported more recently.

What is your sense, given the preliminary work that you've done, of how long-standing this problem has been?

[Jennifer Stoddart]

I don't have an idea on that, because we simply look at the very particular circumstances around one person. We didn't go back and sample to see if this was an old practice or a relatively new one. I think perhaps our audit will give us a better idea of that.