Information & Ethics Committee on Dec. 11th, 2012

[Barbara Bucknell, Strategic Policy Analyst, Legal Services, Policy and Research Branch, Office of the Privacy Commissioner of Canada]

Merci.

I think it is possible, but organizations need to turn their minds on how best to do it, because there are definitely challenges. Certainly in the mobile environment you have a limitation of space and size, but that doesn't mean it's impossible to tell people very simply and clearly, for example, that this is the information we're going to disclose if you download this application.

Our office has been working hard with our online behavioural advertising guidelines as well as our mobile application guidelines, which we recently released, to reinforce the message that yes, it can be done, and that it should be done in simple, clear language. I think we're going to see more of that from our office.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

My next question is about policies on privacy and data usage.

We have noted, like you, that companies have been changing their policies over time. Do you think that companies should have to ask for subscribers' consent again? This question is related to the one on expressed consent. Can companies inform users that they have changed their policies and ask whether they want to continue subscribing?

[Jennifer Stoddart]

I think that companies should let their members, or their clientele, know that the conditions have changed, since the consent the consumer gave when subscribing did not apply to the new conditions. The company should at least indicate that the rules of the game have changed, so that the consumer can have the option to keep or cancel their subscription.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you, Ms. Borg. Unfortunately, your time is up.

I now yield the floor to Ms. Davidson for seven minutes.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you very much, Mr. Chair.

Welcome, Commissioner. It's nice to see you back again, and your colleagues with you. We appreciate your appearance here.

It's been a long study, but it's been a good study, I think. We've heard some very interesting comments and we've heard from some very interesting individuals as well as companies. I think that it has been very beneficial and I'm certainly glad we've undertaken this study.

As you pointed out in your remarks, some “witnesses felt that PIPEDA needs to be modernized; others took the position that PIPEDA does not need to be changed, that its enforcement model works and that its technology-neutral character is its strength.” I'm just reading that from the comments you made earlier.

We heard from a lot of people on both sides of this issue. We heard about concerns with respect to giving broader powers, including the enforcement powers and the ability to issue penalties, and the concerns that some felt this would alter the good relationship that your office currently enjoys with many companies you examine.

Could you respond to that concern? Do you feel it will affect your ability to deal well with these companies? If you had expanded enforcement powers, how is that going to affect your current relationship in dealings with private companies? You've said in your comments that some people say your office cannot be judge, jury, and executioner. How would that work out? How would the balance be there? Would there be checks in place? In your vision, is that final say in your office?

[Jennifer Stoddart]

Thank you, honourable member.

I'm a bit amazed at that statement. It sounds like if we got more power, we would be slinging mud balls at each other. I don't know what hell would break loose if we had enforcement powers.

I had the honour to be the president of a tribunal, one of the ones I mentioned in my speech, that enforced privacy legislation in Quebec, both in the private sector and the public sector. I didn't notice that we had particularly acrimonious relationships with companies in the private sector. I don't notice that my colleagues in British Columbia and Alberta have particularly acrimonious relationships, because they also have an educative role. They also prefer to settle through negotiation, if possible. Nobody really wants to go to court if they can avoid it. They promote the voluntary adhesion to the law.

Therefore I don't see, in those places across Canada where there is some kind of enforcement power, that anybody said the relationships are difficult. If people don't agree and there's one case where you go to the tribunal, well, perhaps people agree to disagree, but I haven't noticed that's prevented my colleagues—or me, when I was in that position myself—from doing educational work, from working with chief privacy officers, from having collegial meetings with the private sector.

I'm a bit perplexed as to that statement.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

We did hear from many people who felt they had an excellent relationship with your office—I think the majority of people felt that—and they certainly did not want to see it jeopardized.

Could you just talk a little bit more about the comment about judge, jury, and executioner? Those are not always very positive words, but how would you see that happening?

[Jennifer Stoddart]

That's another comment that just dumbfounded me. The reality of what we call multifunctional administrative organizations is a concept that is very well known in Canadian law—and, I believe, in British law and arguably in Australian law, to take laws that resemble our public law the most. Both my Australian and U.K. colleagues have different functions: they do education, they do arbitration, they do mediation, they do public outreach, and they also can either impose fines themselves—that's my U.K. colleague—or can go to the court and ask for fines of over $1 million Australian—that's my Australian colleague, so this is a model that's well known internationally.

It's also well known here. Again, my B.C. and Alberta colleagues do education work with us. We've issued several guidance documents together with them. They have a public outreach office and so on, and they are tribunals. They make binding conclusions. Therefore, I don't know why all of a sudden it would be impossible for us, when it has been possible in Alberta, B.C., and Quebec for the last 15 years and it's the rule abroad.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Do those other jurisdictions have any arbitration process?

[Jennifer Stoddart]

I'm not sure—

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

An appeal process, I should say.

[Jennifer Stoddart]

There is an appeal process, yes. In the case of Quebec, there's a direct appeal. I believe in the case of Alberta and B.C. there's judicial review, which to me is usually a higher standard.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

In your remarks you also talked about digital literacy. We've heard a fair amount about that from a very broad range of presenters during this study.

We heard about it when we talked about children, for example, but we also heard about it for adults as well. There is an age group that is fairly well educated about social media. There's an age group that isn't educated well at all. Then we have young kids coming up, learning at a very young age.

When you talk about digital literacy, how do you see that happening? Who do you see being responsible for it? Is it a shared responsibility? Is it something your office would become more involved in down the road?

[Jennifer Stoddart]

Yes.

I would think there are any number of players across Canada, both federally and provincially, in digital literacy issues, depending on whether you're addressing it to school children, parents, young adults, or seniors, who kind of skipped that altogether.

We're involved to the extent of our resources, and we just launched, with the Media Awareness Network, a tool about mobile app guidance for educators in school boards across the country.

There are any number of players. That activity could be developed, but we wanted to bring this tool to your attention.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you, Ms. Davidson. Your time is up.

I now yield the floor to Mr. Andrews.

[Scott Andrews, Liberal, Avalon, NL]

Thank you.

Welcome, folks. It's a pleasure to have you here again.

I always ask a question to witnesses during this testimony about where they raise their privacy bars. Most of all I think these companies, which are basically in the United States, are scared of the FTC. That's the primary privacy body that they listen to. With anything else, I think they're just paying lip service. Is that a fair statement?

Have you seen that these companies, when dealing with your office or other offices in other countries, actually do take some of these things and raise the privacy bar to the highest standard, or are they just taking whatever the FTC says as the minimum, and that's all they're going to do?

[Jennifer Stoddart]

Certainly American companies, which are the major players on the Internet, have the FTC's opinion in their sights.

Could I ask assistant commissioner Chantal Bernier, who directs our day-to-day investigations, to give you a recent example of the truth, I think, of the statement you put forward about the FTC and other privacy commissioners?

[Chantal Bernier, Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada]

Thank you, Commissioner.

Yes. I think this story is quite eloquent.

You may recall, if you have followed the press clippings around our work, that in 2011 we issued a report of findings on Google WiFi. We found that as Google was rolling out Street View, they captured—accidentally, they say, and we have no evidence otherwise—personal information of Canadians. We gave them one year, a full year, to present to us a third party audit assuring us that they had applied all the recommendations we had made.

That timeline was May 20. At the beginning of May we had a meeting with Google, and our request for a third party audit, which was clearly stated in our letter, did not even seem to be on their radar screen. They were rather apologetic, and said “Oh, my God, can we have an extension?” In July, they sent us the third party audit that in fact had been written for the FTC.

I believe that truly goes to your point.

[Scott Andrews, Liberal, Avalon, NL]

Another question I had about recommendations was how we make this apply. How do we make these companies apply the Canadian standard, or your office? Is the only way to make them apply it to bring them to court and put a penalty on it?

How do we make this happen? How do we make them apply our privacy standard?

[Jennifer Stoddart]

Well, from observation over the years, I think it is the only thing that makes them sit up and take notice.

Their names are already public. We're dealing with a far different breed of companies from what existed when PIPEDA was adopted. Lawyers have said to me many times over the years, “I wish there were more sanctions”, or, when I started talking about sanctions, they say they are so happy we are doing that because their client—this could be an outside client at a law firm or the CEO of a company where they are an in-house lawyer—asks them to draw up all the regulatory risks and then asks, “What happens if I don't?”

When they get to privacy, they ask what happens if they fall off the Canadian privacy wagon. Well, I have to say, “Don't worry. There will be an investigation, and in the course of the investigation, you can promise to fix it”, and that's it. That's what the law says. If they promise to fix it and there's an agreement, I don't take them to Federal Court, so they say, “Okay, fine; put it at the bottom of the list.”

As a result, the lawyers who were advising their clients can't get their clients to pay attention to Canadian privacy law because the CEO asks, “What are my biggest risks?” If there's virtually no risk of infringing when you infringe a Canadian privacy law, you move on to other things. That includes data breach, as we were talking about earlier.

[Scott Andrews, Liberal, Avalon, NL]

I will get back to the data breach, because that was the minimum request. If we do put in a penalty, if we do put this into Canadian law, how can the courts enforce this? How can the courts put a penalty on it, if most of their work is in the United States?

How does this cross borders? How we are going to be able to make them pay if they don't live up to our standard?

[Jennifer Stoddart]

I think it's been done already by the Federal Court. I think there's a legal test, a real and substantial connection to Canada. I think many of the companies meet it. It's fairly clear, and that test would have to be met.

We would be levying a sanction for their behaviour involving the personal information of Canadians. I don't think there is a problem of enforcing it. Other countries enforce things against companies headquartered elsewhere. It depends on how your laws are written, but one of the many good things about PIPEDA—the only thing I’m raising here is the lack of enforcement powers—is that PIPEDA is written in a such a neutral way that as long as you have a connection with Canada, it doesn't matter where you are headquartered. It doesn't matter where your servers are, etc. I think that can be dealt with in a rewrite of the law.

[Scott Andrews, Liberal, Avalon, NL]

Have you thought of what range of fines would be appropriate for us?

[Jennifer Stoddart]

Yes. I would think it would be interesting if you looked at the range of fines the European Union is currently contemplating. There's a range of fines; first tier, second tier, third tier. It goes up to a maximum of 2% of worldwide revenue. There's debate about that and so on, but if you look at the fines the FTC is imposing, a range of $20 million to 25 million....

[Scott Andrews, Liberal, Avalon, NL]

The FTC model is interesting because it's not really privacy, it's—