Information & Ethics Committee on April 22nd, 2013

[Chantal Bernier]

Yes. There are two things.

First of all we have a commissionally launched complaint that's into HRSDC as well as Justice. In the case of the USB key, the USB key was lost in the legal services of HRSDC. Therefore, the Department of Justice is also a respondent. So that is an investigation, and it is going at a very good pace, but it is a very good example of the difficulty that technology raises. It is very complex. In addition to that, the facts are very complicated. How do you find out what has happened to a small portable device such as a hard drive or a USB key?

The second is that, when we were informed of the breech, we thought this raised such systemic issues we should not limit our intervention to the mere investigation of that event. So we have decided to develop an audit plan for certain federal institutions, which will be picked according to sensitivity and relevance, and we will look at their management practices around portable devices.

[Scott Andrews, Liberal, Avalon, NL]

Don't portable devices normally have password-protected secure protection? I know my wife's does, the one that she uses with the school.

Is that a practice that was not followed in this example, or is that something that we should be looking at?

[Chantal Bernier]

You will find that in our investigation report. When it is finished, we will be able to establish that.

[Scott Andrews, Liberal, Avalon, NL]

Commissioner, thank you for your service in the role.

If we don't get to the review of PIPEDA, I hope you can give us a presentation before your term is up, or leave something with us to look at, regarding what you think needs to be updated in PIPEDA, if you wouldn't mind.

[Jennifer Stoddart]

Yes, I'm planning to do that within the next month, to go over at a very high level my observations and suggestions for modernizing the act going forward.

[Scott Andrews, Liberal, Avalon, NL]

Thank you.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Unfortunately, Mr. Andrews, your time is up.

Mr. Carmichael now has seven minutes.

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Mr. Chair. I too join my colleagues in welcoming you, Commissioner, and your colleagues.

Clearly, your environment is a challenging one. As I've listened to some of the questions from all sides, I think we're all very well aligned on the challenge that faces you, particularly with the growth of technology, the changing times, and how to adapt to these times.

To begin, could you clarify something I'd like to understand? When we look at the current budget that you presented, is the moving cost a one-time cost that is taken as a capital expense? I come from private business so I'm not sure. It could be a government funding issue in the way it's captured.

Is that a one-time expense that we'll see?

[Jennifer Stoddart]

Yes, it's a one-time expense that's paid back over 15 years, but on how it's captured, I'll leave that to our chief of accounts.

[John Carmichael, Conservative, Don Valley West, ON]

So we will see the annual repayment in some form in future budgets? Is that the idea?

[Daniel Nadeau]

The repayment will be noticed through a decrease in the funding to the amount of about $270,000 a year for 15 years.

[John Carmichael, Conservative, Don Valley West, ON]

Right.

Commissioner, I wonder if we could talk about some of the challenges. You mentioned the social media study, and clearly, we were challenged on that. Every time we opened a new page and entertained a new witness, there was yet a whole new spectrum of challenges that seemed to jump off the page in the social media study, always privacy related.

You talk about some of the challenges that you're facing within the four points that my colleague was asking you about earlier. I wonder if we could talk a little more about those. You mentioned identity, new information, national security, and genetic profiling, was it?

[Jennifer Stoddart]

Genetic privacy, yes.

[John Carmichael, Conservative, Don Valley West, ON]

Could you speak a little more in-depth about that? Obviously, you said, it could take a long time. Maybe you could give us a bigger picture?

[Jennifer Stoddart]

Of what we're doing in each of them?

[John Carmichael, Conservative, Don Valley West, ON]

Yes, those four items, because obviously, as you go forward, you're chasing technology. You mentioned that the laws of the land move slowly to capture these changes, and as you stated, entrepreneurs are creating new ideas and new technologies, and every time you're confronted with one of these new avenues, you have to figure out how to deal with it.

To me, these are areas that are critically important to our day-to-day lives in so many ways. Could you give us a little more depth on that?

[Jennifer Stoddart]

Yes. Thank you, honourable member. These four priorities are just an in-house way—the suggestion came from the personnel—to organize our work because we're constantly bombarded with so much. As you say, there are new technologies and new issues. So what do we decide to prioritize all the questions of privacy that come up? We chose these four.

I'll just, off the top of my head, give you a recent example of each of these. The work can be either prioritizing a complaint or prioritizing an educational vehicle, either a video or publication or a new part of our website, or it could be holding a conference or a publication or a position on draft legislation. So it's the range of all these different vehicles.

As for identity integrity, the example I'll give is that we're soon to release a study on the implications of IP addresses. If you remember in the discussions over the last few years, particularly about draft legislation that has been withdrawn at this time, there was a debate about what you could find out from an IP address if the police had warrantless access to an IP address. Was it just like reading a phone book in the good old days? I don't know if you remember that debate.

In our laboratory we did an online study of what you could find out using IP addresses. We hope to publish that within the next few weeks. To give you a preview—and I think this is going to demonstrate why we kind of stuck to our position that an IP address is more than an old-fashioned phone book—unlike a phone book it leads to other things, other activities and other actions that you may have taken on the web.

In terms of new technology, my goodness, there is a tonne of that. In the coming year we are going to increasingly look at facial recognition analysis. One area that's fascinating and chilling that we've been following for several years in new technology is unmanned aerial vehicles, which we know as drones. How many drones are in Canada? What is the use of them? What are the rules around them? What could go wrong in the use of drones? What are the privacy implications?

As for genetic information, we've funded several studies through our contributions program. We've had some studies done for ourselves. Perhaps the most recent thing we have done is examine draft legislation proposed by Senator Cowan, I believe, before the Senate, Bill S-218, an act to prohibit and prevent genetic discrimination, which is an issue we've been following for some years.

National security has been a huge file for us over the years. I'll talk about the work we did—I was out of the office and the assistant commissioner appeared—to support the recent Bill C-55, An Act to amend the Criminal Code, to implement the Supreme Court decision on cases and conditions for warrantless access.

That's a smorgasbord of what we do.

[John Carmichael, Conservative, Don Valley West, ON]

Excellent. Thank you very much.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Ms. Borg, you may go ahead for five minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you kindly, Mr. Chair.

Ms. Stoddart, I, too, would like to thank you for all your hard work over the past 10 years and for your dedication to an important cause, protecting Canadians' privacy.

My first question is as follows.

In the case of Nexopia, especially, we saw that when organizations choose not to comply with your recommendations, you could end up going to court. I would like to get a sense of what type of a burden that represents for your office. How much time and money do you have to invest in that type of legal activity?

[Jennifer Stoddart]

Thank you for the question, Ms. Borg.

It's a little ironic, because if you look at the annual reports we've produced since I've been in office, you see that very few legal actions end up being heard on the merits. We go to the Federal Court to try to bring the private sector to implement our recommendations. It's exceedingly rare for organizations to challenge us to the very end. They prefer to settle out of court. But, in order to force them to settle out of court—a decision they could have made earlier—we have to go through the process, obtain findings, hire lawyers, go to the Federal Court and wait for the action to take its course. That can go on for a certain amount of time before someone in the organization realizes how serious the matter is and how strong our arguments are. They are forced to choose between withdrawing or settling out of court because we have sound arguments.

That's the pattern we've observed over the years. And, by the way, that's one of the reasons I became convinced of the importance of saying, this process has to be more efficient for Canadians. What's more, my office's resources are steadily decreasing, and we have to ensure that these settlements happen sooner.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

You also said it was imperative that your office continue to work not just with the provinces, but also with other countries. What should be done? That's probably a piece of advice for the next commissioner. How can that cooperation be maintained? How can Canada help tackle this problem, which has entered the international realm given the nature of the data?

[Jennifer Stoddart]

If I may, Ms. Borg, I would ask the assistant commissioner to answer that, considering how involved she is in the international network of privacy commissioners, which is working towards the very thing you mentioned.

[Chantal Bernier]

I would start by saying that the Office of the Privacy Commissioner of Canada is not the only organization to understand the importance of establishing a set of international privacy standards. There is no doubt about that, given the fact that the information flows all around the world.

In 2011, at the International Conference of Data Protection and Privacy Commissioners in Mexico City, a resolution was adopted to create a working group on international cooperation in the enforcement of laws protecting privacy. The resolution is implemented by a working group co-chaired by our commissioner and her British counterpart.

The working group brings together a small number of privacy commissioners from around the world for the purpose of identifying barriers that can be addressed cooperatively and finding ways to overcome them to foster effective cooperation. The confidentiality rules are a tangible example. We are all bound by confidentiality rules. In order to work with other authorities, we need a protocol to protect the confidentiality of our investigations. We've now signed protocols with four countries, Great Britain, Germany, the Netherlands and Ireland.

I will give you a real example of how we used that new power. We conducted the first international investigation with the Netherlands. Both we and our Dutch colleagues had concerns about WhatsApp, an American company that produces an application by the same name.

So we pooled our resources. They did the technological analysis and we did the legal analysis and handled the negotiations with the company. We conducted two coordinated investigations. In my view, the results were excellent, partly because the company was up against two agencies responsible for the protection of personal information, instead of just one.

In addition, we are building a very intensive network. We give many talks around the world, and we are contributing to the development of an international normative framework.

The commissioner was at the OECD, in Paris, to help develop, consolidate and update the OECD's guidelines. The same week, I was in Mexico, and I gave two talks to our Mexican counterparts and at the University of Mexico on the international dimension of protecting personal information.

[The Chair, NDP, Pierre-Luc Dusseault]

Thank you.

Ms. Bernier, I must stop you there. Ms. Borg is out of time.

Mr. Butt, the floor is yours. You have five minutes.