Information & Ethics Committee on April 22nd, 2013

[Jennifer Stoddart]

Thank you for the question.

Just to put it in context, honourable member, the office has been in the same building in downtown Ottawa, not far from here, for almost its whole existence. This building is being renovated, therefore we were told we had to vacate the premises. At that point, of the new state-of-the-art buildings that were available and were close by, one was free in Gatineau, which also attracted the interest of other agents of Parliament. This is a big move. The whole office, then, was forced to make this move.

Unlike other departments, to follow up on another honourable member's question, we don't have bits of cash left around through which we can finance a move. That's why we had to get specific money.

The move impacts the personnel and it impacts almost all our operations. Not only do we move to a new kind of template for workspace, but we have to renew a lot of our IT equipment, even our phone lines and so on, so that is going to be a big and costly change.

The transition, I think, is being very ably managed by Mr. Nadeau and his staff. However, it is disruptive. For this reason we have not set ourselves any ambitious, new goals for this year. We're trying to continue on with our work and ensure an orderly transition, both to a new office and for a new commissioner.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

In this new location you're going to be sharing resources with other officers of Parliament. Is that correct?

[Jennifer Stoddart]

Yes, we are.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

How many other officers?

[Jennifer Stoddart]

The other officers in the building are Elections Canada—it has the largest space—the Information Commissioner, and the Commissioner of Official Languages.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Does the sharing of some of the office space resources pose any issues when it comes to privacy?

[Jennifer Stoddart]

No, I don't think so because we would raise that consistently because that's our job. We cannot share things to the extent that the personal information of Canadians is compromised. Those are some of the discussions that Daniel Nadeau has with his counterparts.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Okay. You talked in your opening remarks about your four policy priorities. Could you just outline those again briefly for me?

[Jennifer Stoddart]

Yes, the four policy priorities for some years have been identity integrity, new information technology, national security, and genetic privacy.

[The Chair, NDP, Pierre-Luc Dusseault]

Ms. Davidson, I would ask that you keep it brief. You have just a few seconds left.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

I was just going to ask what progress you've made on those priorities since they've been introduced.

[Jennifer Stoddart]

That's a question that would take a long time to answer. We're trying to cap off those activities specifically with a different event, or a publication this year just to mark a pause and try to look back and see what we've done. So there are different activities or publications for each of them.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

It is now Mr. Andrews' turn, for seven minutes.

[Scott Andrews, Liberal, Avalon, NL]

Thank you very much, Mr. Chair.

Welcome, Commissioner, again.

My first question is regarding the investigative complaints and the time that is required to investigate complaints. How are your statistics on the number of complaints you've been getting and the timeframe in which you've been responding to them? You mentioned in your introduction that you've been getting more complaints as more people get knowledgeable. Have you been tracking your statistics on how successful you have been in investigating these?

[Jennifer Stoddart]

Yes. We track these very carefully on a monthly, and indeed a weekly basis.

Could I refer the rest of this question to the assistant commissioner who oversees the complaint process? Thank you.

[Chantal Bernier, Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada]

Thank you for your question because this is good news. This is a good news story. Indeed the complaints have increased, yet through the efficiencies we have managed to build into our processes through the modernization process the commissioner was just referring to, we have been able to actually reduce timelines.

For example, in spite of an increase in complaints, we have reduced the timelines for the complaints' management or treatment from 14.3 months to 12.6 months.

In addition to that, we have an increase of 46% in early resolution, which means the complainant doesn't even necessarily have to file a complaint that goes through an investigation, but gets resolution in a timely fashion.

[Scott Andrews, Liberal, Avalon, NL]

What is the biggest demand or time constraint on your investigative unit? Is it dealing with the outside agencies, the inside agencies, departments? What's the biggest drain on your resources?

[Chantal Bernier]

You have just named it. Clearly the delays by the respondents are a huge factor and a factor over which we have little control.

We do make a point of insisting on them meeting their timelines. But going back to further questions on what is the impact and what is the pressure, the technological complexity, which was mentioned earlier, means it's tougher for all of us, the investigators as well as the respondents, to establish what has truly happened in a breech.

[Scott Andrews, Liberal, Avalon, NL]

Commissioner, you talked about beginning an audit in regard to the electronic storage devices. Can you give us a little idea of what the scope of that audit is going to be? Can you give us a general idea of how far it's going to reach? You just mentioned it.

As for the second part of the question, when we look at these storage devices, storing information on a device is nothing new. It has been going on for some time, back to the floppy disk, but it seems to have been heightened with this recent data breech.

Are there any practices in the past that the departments should, are, or are not following with regard to storage devices?

[Jennifer Stoddart]

Could I again refer this to the assistant commissioner who is supervising this process too?

[Chantal Bernier]

We would break down the protective measures into three categories: physical, electronic, and procedural.

Physical measures concern all the areas where sensitive information, personal information, is held. They ensure that the access is properly monitored and that drawers and filing cabinets are properly locked.

Second, there are electronic measures. These are all the procedures such as encryption, for example, and solid passwords. If you look at our audit on wireless, for example, of certain federal institutions a few years ago, we found that the passwords were not secure and that threat and risk assessments on the wireless technology were not properly made.

Then the third category is procedural. That includes all the policies surrounding the management of the information, for example, who has access to various information. How do we have audit trails to monitor access?

So we look at the procedures, the structure of protection, through these three lenses to see if, indeed, all the protective measures, the safeguards, are in place.

[Scott Andrews, Liberal, Avalon, NL]

How wide is your audit going to be?

[Chantal Bernier]

Are you referring to the investigation in HRSDC, or are you referring to the wireless audit that I've just referred to?

[Scott Andrews, Liberal, Avalon, NL]

The HRSDC audit. When the commissioner mentioned audit, I didn't know if the two were linked.