Evidence of meeting #74 for Access to Information, Privacy and Ethics in the 41st Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was year.

A video is available from Parliament.

On the agenda

MPs speaking

Also speaking

Jennifer Stoddart  Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Daniel Nadeau  Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada
Chantal Bernier  Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

3:50 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Thank you for the question.

Just to put it in context, honourable member, the office has been in the same building in downtown Ottawa, not far from here, for almost its whole existence. This building is being renovated, therefore we were told we had to vacate the premises. At that point, of the new state-of-the-art buildings that were available and were close by, one was free in Gatineau, which also attracted the interest of other agents of Parliament. This is a big move. The whole office, then, was forced to make this move.

Unlike other departments, to follow up on another honourable member's question, we don't have bits of cash left around through which we can finance a move. That's why we had to get specific money.

The move impacts the personnel and it impacts almost all our operations. Not only do we move to a new kind of template for workspace, but we have to renew a lot of our IT equipment, even our phone lines and so on, so that is going to be a big and costly change.

The transition, I think, is being very ably managed by Mr. Nadeau and his staff. However, it is disruptive. For this reason we have not set ourselves any ambitious, new goals for this year. We're trying to continue on with our work and ensure an orderly transition, both to a new office and for a new commissioner.

3:50 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

In this new location you're going to be sharing resources with other officers of Parliament. Is that correct?

3:50 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Yes, we are.

3:50 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

How many other officers?

3:50 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

The other officers in the building are Elections Canada—it has the largest space—the Information Commissioner, and the Commissioner of Official Languages.

3:50 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Does the sharing of some of the office space resources pose any issues when it comes to privacy?

3:50 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

No, I don't think so because we would raise that consistently because that's our job. We cannot share things to the extent that the personal information of Canadians is compromised. Those are some of the discussions that Daniel Nadeau has with his counterparts.

3:55 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Okay. You talked in your opening remarks about your four policy priorities. Could you just outline those again briefly for me?

3:55 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Yes, the four policy priorities for some years have been identity integrity, new information technology, national security, and genetic privacy.

3:55 p.m.

NDP

The Chair NDP Pierre-Luc Dusseault

Ms. Davidson, I would ask that you keep it brief. You have just a few seconds left.

3:55 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

I was just going to ask what progress you've made on those priorities since they've been introduced.

3:55 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

That's a question that would take a long time to answer. We're trying to cap off those activities specifically with a different event, or a publication this year just to mark a pause and try to look back and see what we've done. So there are different activities or publications for each of them.

3:55 p.m.

Conservative

Patricia Davidson Conservative Sarnia—Lambton, ON

Thank you.

3:55 p.m.

NDP

The Chair NDP Pierre-Luc Dusseault

Thank you.

It is now Mr. Andrews' turn, for seven minutes.

3:55 p.m.

Liberal

Scott Andrews Liberal Avalon, NL

Thank you very much, Mr. Chair.

Welcome, Commissioner, again.

My first question is regarding the investigative complaints and the time that is required to investigate complaints. How are your statistics on the number of complaints you've been getting and the timeframe in which you've been responding to them? You mentioned in your introduction that you've been getting more complaints as more people get knowledgeable. Have you been tracking your statistics on how successful you have been in investigating these?

3:55 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Yes. We track these very carefully on a monthly, and indeed a weekly basis.

Could I refer the rest of this question to the assistant commissioner who oversees the complaint process? Thank you.

3:55 p.m.

Chantal Bernier Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Thank you for your question because this is good news. This is a good news story. Indeed the complaints have increased, yet through the efficiencies we have managed to build into our processes through the modernization process the commissioner was just referring to, we have been able to actually reduce timelines.

For example, in spite of an increase in complaints, we have reduced the timelines for the complaints' management or treatment from 14.3 months to 12.6 months.

In addition to that, we have an increase of 46% in early resolution, which means the complainant doesn't even necessarily have to file a complaint that goes through an investigation, but gets resolution in a timely fashion.

3:55 p.m.

Liberal

Scott Andrews Liberal Avalon, NL

What is the biggest demand or time constraint on your investigative unit? Is it dealing with the outside agencies, the inside agencies, departments? What's the biggest drain on your resources?

3:55 p.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Chantal Bernier

You have just named it. Clearly the delays by the respondents are a huge factor and a factor over which we have little control.

We do make a point of insisting on them meeting their timelines. But going back to further questions on what is the impact and what is the pressure, the technological complexity, which was mentioned earlier, means it's tougher for all of us, the investigators as well as the respondents, to establish what has truly happened in a breech.

3:55 p.m.

Liberal

Scott Andrews Liberal Avalon, NL

Commissioner, you talked about beginning an audit in regard to the electronic storage devices. Can you give us a little idea of what the scope of that audit is going to be? Can you give us a general idea of how far it's going to reach? You just mentioned it.

As for the second part of the question, when we look at these storage devices, storing information on a device is nothing new. It has been going on for some time, back to the floppy disk, but it seems to have been heightened with this recent data breech.

Are there any practices in the past that the departments should, are, or are not following with regard to storage devices?

3:55 p.m.

Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada

Jennifer Stoddart

Could I again refer this to the assistant commissioner who is supervising this process too?

3:55 p.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Chantal Bernier

We would break down the protective measures into three categories: physical, electronic, and procedural.

Physical measures concern all the areas where sensitive information, personal information, is held. They ensure that the access is properly monitored and that drawers and filing cabinets are properly locked.

Second, there are electronic measures. These are all the procedures such as encryption, for example, and solid passwords. If you look at our audit on wireless, for example, of certain federal institutions a few years ago, we found that the passwords were not secure and that threat and risk assessments on the wireless technology were not properly made.

Then the third category is procedural. That includes all the policies surrounding the management of the information, for example, who has access to various information. How do we have audit trails to monitor access?

So we look at the procedures, the structure of protection, through these three lenses to see if, indeed, all the protective measures, the safeguards, are in place.

4 p.m.

Liberal

Scott Andrews Liberal Avalon, NL

How wide is your audit going to be?

April 22nd, 2013 / 4 p.m.

Assistant Privacy Commissioner, Office of the Privacy Commissioner of Canada

Chantal Bernier

Are you referring to the investigation in HRSDC, or are you referring to the wireless audit that I've just referred to?

4 p.m.

Liberal

Scott Andrews Liberal Avalon, NL

The HRSDC audit. When the commissioner mentioned audit, I didn't know if the two were linked.