Information & Ethics Committee on Feb. 14th, 2011

[Chantal Bernier]

Absolutely. We are in complete agreement with that. We work a lot with Ms. Cavoukian. This is the very approach we take when we review privacy impact assessments. Once the portal is created and submitted to us, we will obviously consider it based on very specific criteria. In the first place, the portal should not provide access to personal information. The main objective of open government is to provide information of public interest. Clearly, we will assess all the technological aspects of the portal in order to ensure that personal information is not disclosed accidentally.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

Okay, I understand.

Ms. Bernier, I am under the impression that you work very closely with commissioners in charge of privacy and access to information from all over the country, even the world. I've noticed that Ms. Stoddart has a very good working relationship with the American government. She works in Europe as well. She is a true champion. She is always being congratulated on all her initiatives.

I have the impression that you work with all those people, but not with the federal government. Am I right?

[Chantal Bernier]

Because of all the reviews of privacy impact assessments we conduct, we work very closely with the public federal sector. In addition...

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

What do you mean by the federal public sector?

The Treasury Board Secretariat is responsible for applying the Access to Information Act. You say that you have not been involved in the process and that you have not worked with that body. However, you just said that you work closely with everyone. In other words, you do some work, here and there, with departments that publish data, but you do not work with all of them or in a structured way. An open government—and all the witnesses have confirmed this—requires a political will that comes from the top. We are talking about the Treasury Board Secretariat and the department in charge. However, your testimony and your answers to our questions lead us to believe that you were never consulted about the implementation of this project or even of the portal. You say that you work closely with the federal government, but I don't see how you are doing that, except when departments consult you from time to time.

I was asking you if you work with all departments and in a structured way, with a clearly outlined political will from the top.

[Chantal Bernier]

You understand that we are agents of Parliament.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

Yes.

[Chantal Bernier]

Therefore, we are independent. However, I will clarify how we collaborate. We regularly meet with people from the Treasury Board Secretariat to discuss various topics. We were consulted about and commented on the set of privacy policies that the Secretariat recently developed and published. However, they are clearly free to follow or not follow our recommendations. We have still not been consulted about a portal. We have not received any privacy impact assessments on the issue.

[Carole Freeman, Bloc, Châteauguay—Saint-Constant, QC]

So then, you were not consulted overall about a portal that would reflect an open government.

Thank you, Ms. Bernier.

[The Chair, Liberal, Shawn Murphy]

Merci, Madame Freeman.

We're now going to go to Mr. Siksay for seven minutes.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Thank you, Chair, and thank you for being here, Madame Bernier and Mr. McKay.

Madame Bernier, you've described the privacy impact assessments that you expect when government moves to post personal information or data sets. We've seen in other jurisdictions a really massive increase in the amount of government data that's published and made accessible to folks. Do you anticipate, if we go to this system of a more open government and more open data, an increase in your workload in terms of having to do privacy impact assessments of that kind of massive change in how government approaches publishing its data?

[Chantal Bernier]

It is possible, but I would say that we welcome it, in the sense that, as our colleague Ann Cavoukian says, that review of privacy impact assessments really does allow us to instill privacy by design, because if all works well, the privacy impact assessment comes to us before the program or initiative is implemented, which means that we can, right at the inception, make recommendations on how best to protect privacy.

I would expect that the more information is released, the more we will need to ensure safeguards of personal information, so it could indeed impact on our workload; however, I think it would also enhance transparency and privacy at the same time.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Are you anticipating having to review the impact of each data set that is released, or do you make sure that a department would have something in place so that, if that department does it, you don't have to do it for each data set? Otherwise, are you looking at individual data sets specifically?

[Chantal Bernier]

Thinking of the wording of the Treasury Board directive that concerns privacy impact assessments, I would say that they would have to submit for our review any initiative or measure that could have an impact on the handling of personal information. That could mean, therefore, that as soon as there is a change in any measure, I would expect it to be put to us to ensure that privacy is duly reflected.

My colleague would like to add something.

[Colin McKay, Director, Research, Education and Outreach, Office of the Privacy Commissioner of Canada]

In the point we made about privacy by design, what's also important is that government database managers put in the controls within their own systems so that they understand the impact of the information they're considering for release. Ideally, they have structured their data sets so that they know ahead of time, before they come to us, the scope of what they're considering releasing and how it may interrelate with other data sets that have been made available.

One of the things we're doing as well is speaking to statisticians about guidance and possible explanatory materials for both public servants and private sector individuals who are considering this sort of data set publication, to give them some advice on whether or not they're entering into a situation in which there might be the disclosure of personal information.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You touched on the extra privacy implications related to combinations of data sets and gave an example. How do you possibly put in place a policy that deals with the possibilitiy of personal information being disclosed when different data sets are being disclosed across the breadth of government? How would you know how one department's data would affect things in combination somewhere else, and how do you put a system in place that would challenge people to make those kinds of considerations?

[Colin McKay]

Luckily, as was mentioned, we have other governments that are ahead of the game. The United States and Britain have put into place processes that approach the release of data sets in a more structured way, and they take into consideration those sorts of complications and try to anticipate them. As assistant commissioner Bernier mentioned, we've had cases in which we've had to take steps to make sure that data sets weren't released, simply because there was the potential for that sort of re-identification, but it is really an opportunity to structure our information holdings in a more efficient way to allow us to handle them in such a way that they can be given to the public for further processing, rather than trying to avoid crises and avoid complications.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Madam Bernier flagged that training in the IT department was something that would need to be done around all of this. Has that kind of training begun, or have you been asked to provide that kind of training? What would be done differently from what is happening now, for instance? What kind of training would be necessary?

[Chantal Bernier]

Well, first of all, as my colleague said, we have technologists who are capable of looking at how different databases could possibly work together. They are capable of analyzing the technological impacts of various initiatives.

In relation to training, of course it is the first responsibility of the departments to train their staff and to put in place the technological and policy safeguards that protect privacy. That being said, we also contribute. For example, we have training on our expectations in relation to privacy impact assessments. We have training to the School of Public Service on the rights to privacy in policies. However, it is first and foremost the department's responsibility to ensure that they develop policies and practices that are respectful of privacy.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Are you concerned about consistency across government with regard to training, or would you have any input into that?

[Chantal Bernier]

The Treasury Board Secretariat should ensure, absolutely, the highest level of training and cohesiveness among the public service.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay.

Thank you, Chair.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Siksay.

Go ahead, Ms. Davidson, for seven minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thanks very much, Mr. Chair, and thank you, Madame Bernier and Mr. McKay, for joining us this afternoon.

I think that we're all in agreement that more open government is certainly something we're all working towards, but I think we also recognize that there are a lot of complexities to the issue that we definitely need to understand better so that we know where we're going.

You talked about open government definitely being a clear principle of democracy. I think that's a very commonly held thought, but from what you've just told us, ithere's also a pretty delicate balance between open government and protection of privacy.

I'm wondering if you could elaborate a little bit more on how we achieve that balance. Can we achieve it without putting in unreasonable time constraints?

[Chantal Bernier]

The first step of the balance is to ensure that open government actually does not jeopardize the protection of personal information. That is done through policies that will direct staff on how to put information forward in an open government context and through making sure that the technology, the electronic infrastructure that would support open government, is sound and cannot be compromised to reach protected personal information.

Should personal information be disclosed—because, for example, there is a consideration that it is within the public interest—then that “public interest” definition should be quite clear so that there is indeed consistency and legitimacy to that decision.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay.

In your opening remarks you talked about specific concerns in using data compiled from different areas or different departments. Of course, we've been told over and over again that for open government, data have to be in an extremely usable form so that people can take the data from wherever and manipulate or use the data in whatever way they determine is in their best interest.

How do you safeguard against data being manipulated in some form that is going to be dangerous for protection of privacy?