Information & Ethics Committee on Nov. 27th, 2014

[The Chair, NDP, Pat Martin]

Good afternoon, ladies and gentlemen. Welcome. Thank you all for being here.

I apologize for missing the first hour. The planning side of the meeting was done away with.

Welcome to the Standing Committee on Access to Information, Privacy and Ethics. We're very pleased to have an hour today with the Privacy Commissioner and officers from the Office of the Privacy Commissioner.

If I can, Mr. Therrien, we have one housekeeping matter that we should deal with first.

There has been a change in the second vice-chair of the committee. The Liberal Party would like to have on the record a new person to take that position. I open the floor for nominations for a new second vice-chair from Liberal Party.

Mr. Menegakis.

[Costas Menegakis, Conservative, Richmond Hill, ON]

I move that Mr. Scott Simms be the second vice-chair.

[The Chair, NDP, Pat Martin]

I see.

Are there any further nominations?

Seeing none, nominations are closed.

Mr. Simms, would you consider accepting the nomination to be the second vice-chair of the Standing Committee on Access to Information, Privacy and Ethics?

[Scott Simms, Liberal, Bonavista—Gander—Grand Falls—Windsor, NL]

In the absence of Arnold and I flipping over it, yes I'll take it. Thank you.

[The Chair, NDP, Pat Martin]

Okay. That's done.

Democracy has been served.

Welcome, Mr. Simms. I'm sure you'll be a valuable addition to the committee.

[Scott Simms, Liberal, Bonavista—Gander—Grand Falls—Windsor, NL]

Thank you, sir.

[The Chair, NDP, Pat Martin]

Having said that, we only have one hour. Are there any other preliminary matters?

Without any further delay, we will introduce the officer of Parliament, the Privacy Commissioner Mr. Daniel Therrien.

Welcome. Mr. Therrien.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Good afternoon, Mr. Chair and members of the committee. I thank you for the opportunity to address our submissions under the supplementary estimates and any questions you may have. Joining me today is Daniel Nadeau, our chief financial officer, and Patricia Kosseim, our senior-general counsel.

I would like to begin by explaining our submissions, and I will subsequently discuss some of our short-term priority issues.

First, let me explain the reason behind what is, in effect, a reinjection of almost $59,000 into our budget. As explained to this committee by my predecessor, our office made a mandatory move from Ottawa to a new facility in Gatineau in February 2014. The move's costs were forecasted mainly based on estimates provided by Public Works and Government Services Canada.

To cover them, the office needed to obtain a $4.1-million interest-free loan from the fiscal framework negotiated through the Treasury Board Secretariat and Department of Finance. We are repaying this loan over 15 years, ending in 2028-29.

The most recent main estimates reflected our first payment in 2014-15 of some $275,000. Since that time, however, the move's costs came in lower than expected. As a result, we returned nearly $900,000 to the fiscal framework, and our annual repayment figure decreased by some $59,000. And it is this latter figure which, in essence, would be returned to our office and be reinvested in our program activities.

I'll now move on to the other item for which we made a submission.

As you know, our office is one of three partners, along with the CRTC and the Competition Bureau, mandated to enforce Canada's anti-spam law. Our enforcement responsibilities under this law relate to the harvesting of electronic addresses in which bulk lists of email addresses are compiled for use by spammers and the collection of personal information by accessing computer systems primarily through what's known as spyware.

In order to gather reports and intelligence regarding these and other activities under the legislation, the government decided to create the Spam Reporting Centre, which is managed by the CRTC. You may remember that it was the government's initial plan to outsource the management of this centre to a private sector operator. However no compliant bids were received, so the CRTC stepped up to take on the role. The CRTC also sought the systems from partners to support the centre's analytical functions.

As a result, in 2011, it was agreed that our office would fund an analyst position at the centre and to that end we signed a two-year administrative arrangement in early 2014. The $125,000 we are transferring to the CRTC pays for an analyst to work on our behalf at the centre. This analyst was in place for CASL's coming into force in July of this year.

Now that the centre is operational, Canadians have been able to submit reports about unsolicited commercial electronic messages. The analyst's work has greatly assisted our office in identifying purveyors of address harvesting. This work has already contributed to identifying potential address harvesting cases for investigation.

Let me now turn to explaining how I plan to align the priorities of the OPC to the new realities brought forth by the emergence of today's increasingly digital economy and society. The digital revolution has truly opened up a new world, one of new technologies that have the potential of bringing benefits to us all. But this new world also comes with new risks for privacy. Take for instance the issue of big data. Rapidly increasing computer power and analytics capacity may help better identify threats and solutions to public health for emergency issues. But it can also lead to decisions about individuals based on inaccurate or incomplete information or data that people may have provided for different purposes altogether.

On top of this, while more information than ever before is being collected and processed, this raises the risk of data breaches calling for greater attention and ingenuity being devoted to cybersecurity. These are just a few of the rather complex issues confronting our office, organizations, and individuals.

Given our rapidly changing environment, we're embarking on an exercise to establish new privacy priority issues to meet the most pressing privacy challenges. In this exercise, our office will be engaging representatives from business, government, civil society, and academia. We will also be consulting focus groups to gauge the views of the general public.

The new privacy priorities resulting from the process will help hone our focus to make best use of our limited resources and further our ability to inform parliamentarians and protect and promote Canadians' privacy rights. I expect this process will be completed by spring 2015, and I look forward to sharing our outcomes with parliamentarians.

Mr. Chair and members, let me conclude now by underlining what lays at both the core of our work and of privacy, overall.

While the world around is rapidly changing, the value of privacy remains timeless. This is central to Canada's privacy laws and, therefore, to our priority-setting exercise.

I want to ensure that we stay ahead of the curve in a complex and quickly changing world, so we can ensure Canadians can exercise some control over their personal information. This will enable them to partake in the digital economy as informed and confident consumers, embracing new innovation with trust, rather than trepidation.

Rather than an impediment, effective privacy protection can and should be an enabler of innovation. It is my hope and ambition that the work of our office will be as effective as possible in helping organizations mitigate the risks of this new world in order to maximize its many opportunities.

Thank you.

I look forward to your questions.

[The Chair, NDP, Pat Martin]

Thank you, Mr. Therrien.

We only have one hour, so we want to move right away to questions. I'm sure MPs have a lot of questions. These are seven-minute rounds and that includes the question and the answer, so I'd ask the questioners and responders to please be concise and crisp in your answers.

First up, then, is Charmaine Borg for the official opposition, the NDP.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

Mr. Therrien, I would like to thank you for your testimony. I would also like to welcome all my new committee colleagues, since this is the first time we are meeting.

In your speech, you said that there are a number of challenges when it comes to privacy. The digital world is constantly changing. The Supreme Court ruling in Spencer is a prime example. You have already underlined that adjustments should be made to the Canadian legislation, particularly with respect to Bill C-13 and Bill S-4.

Could you please provide more detail about your perspective on this matter and tell us what you think the government should do to reduce the ambiguities that followed from the Supreme Court ruling?

[Daniel Therrien]

Thank you for your question.

As I explained before a Senate committee recently, the Supreme Court ruling in Spencer is a very important step forward in privacy law. Before the ruling, it was difficult to know whether the information that Canadians were putting on the Internet could receive strong constitutional protection of privacy. However, the Spencer ruling clearly states that personal information ultimately related to a person's activities on the Internet can in fact receive strong constitutional protection.

There are lessons to be learned from that. Although the Supreme Court did not rule on the evidence required for a government to gain access to information that constitutes a reasonable expectation of privacy, in these conditions, we can expect the government to have access to that information only if there are what we call “reasonable grounds to believe”, which is generally the standard applicable here, and not on suspicion.

I think there is a link between the sensitive nature given to information by the Supreme Court and the evidence required for the government to have access to that information.

I will stop there.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Great. Thank you very much.

Many bills address privacy, including Bill C-13 and Bill S-4. Bill C-44 does not deal directly with privacy, but it expands the mandate of CSIS.

Are you concerned about the lack of parliamentary or civilian oversight related to expanding CSIS' mandate?

[Daniel Therrien]

In my opinion, Bill C-44 has an impact on privacy, in that it directly gives CSIS an extraterritorial mandate. That implies that information is being shared between the secret services and certain foreign agencies. That sharing of information is an issue that affects privacy very directly. That is where my concerns lie.

Obviously, CSIS already receives independent oversight from an agency called SIRC. However, as I'm sure you know, recommendations have been made about this. Particularly in the Arar case, Justice O'Connor highlighted the shortcomings in Canada's independent oversight mechanisms. He recommended that all government agencies involved in national security be subject to independent oversight, much like CSIS.

I would add that Bill C-44 deals with CSIS's mandate and, indirectly, the sharing of information by CSIS. However, it is important to know that the information obtained by CSIS is then shared with some federal organizations, which may not be subject to independent oversight. That is the case with the Canada Border Services Agency, for example. It is this lack of oversight by independent agencies that is worrisome.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Mr. Chair, do I have any time left?

[The Chair, NDP, Pat Martin]

You have two minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Perfect.

[The Chair, NDP, Pat Martin]

The luxury of time.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I would like to come back to Bill C-13 and Bill S-4.

If these two bills remain unchanged, are you afraid they will raise legal issues? Will it have any impact on your office? Will it make your work difficult?

[Daniel Therrien]

If the standard of proof I spoke about—that is, if the reasonable grounds to suspect remain—that would certainly lead to constitutional challenges. There would also be a certain ambiguity or uncertainty for awhile, until the courts make a ruling in that respect. I think that the courts will deem this standard unconstitutional. So there will be some ambiguity or uncertainty during that period.

The other issue that Bill C-13 raises is the immunity clause. Under that clause, telecommunications companies, and others, that voluntarily provide information upon request by the government would be protected by the immunity clause when they provide information that should be protected pursuant to Spencer.

Will the communicated information be shared because it represents a reasonable invasion of privacy? There is some ambiguity there and, until the courts have ruled on these two issues in particular, Canadians will be pretty much in the dark for a certain period of time.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

[The Chair, NDP, Pat Martin]

Thank you.

Perfect timing, that's exactly seven minutes.

Next, then, we'll be going to the Conservatives, led by Mr. Costas Menegakis.

[Costas Menegakis, Conservative, Richmond Hill, ON]

Thank you, Mr. Chair.

Thank you, Commissioner, and to your officials for appearing before us today. I certainly found your testimony very interesting and informative.

The first question I'd like to ask is with respect to the move. There was $4.1 million, a one-time loan. Has that move been completed now? Are you fully operational in your new offices? Is everything operating as you would like it to be?

[Daniel Therrien]

Yes. We're well in place in our new offices, yes.

[Costas Menegakis, Conservative, Richmond Hill, ON]

I noted that one of the comments you made in your presentation was you want to ensure, you say, “that we stay a head of the curve in a complex and quickly changing world.” In so doing, can you elaborate on whether or not you have discussions with other countries, let's just say international friends that we have, in sharing best-business practices and accomplishing the challenge of staying ahead of the curve?

[Daniel Therrien]

Yes. I was at an international conference of privacy and data protection commissioners, in October actually, on current issues or upcoming issues with respect to privacy. The issue of big data was among those discussed, and also the privacy implications of the Internet, which also raises issues with respect to big data analytics. We are in contact with other privacy commissioners, or what are known in other countries as “data protection authorities”, to follow trends and discuss these issues so that we can recommend as good a protection as possible for individuals.