Information & Ethics Committee on May 1st, 2018

[Peter Kent, Conservative, Thornhill, ON]

We've discovered in the largely borderless digital world a variety of jurisdictions and inappropriate, if not criminal, activity in different jurisdictions involving associated companies. Do you have the authority to find wrongdoing under your current mandate?

[Daniel Therrien]

No, I do not. I cannot impose an administrative fine and I do not have any jurisdiction with respect to criminal behaviour.

[Peter Kent, Conservative, Thornhill, ON]

Is your annual report to Parliament due this spring?

[Daniel Therrien]

It's in September that we usually table it—

[Peter Kent, Conservative, Thornhill, ON]

Oh, it's in September.

[Daniel Therrien]

—when Parliament returns after the summer break.

[Peter Kent, Conservative, Thornhill, ON]

Will you be renewing your request for greater authority, greater ability to apply meaningful penalties?

[Daniel Therrien]

Yes.

[Peter Kent, Conservative, Thornhill, ON]

With regard to penalties, on April 18, just a couple of weeks ago, the government published in the Canada Gazette the long-overdue regulations for mandatory breach reporting and record keeping in Canada. I would just recall for our audience that on June 18, 2015, the previous Conservative government passed the Digital Privacy Act to amend PIPEDA.

Most of that act came into force then, but it's taken three years for the new regulations on mandatory privacy breach notification. We are told it will only come into effect in November, although it's been long expected by those who are aware they will come under the provisions of this reporting. Is that a justifiable delay in your mind?

[Daniel Therrien]

I think this could have come into force much earlier than November, so I think it's late in coming. It's of course welcome news, but it's late in coming.

[Peter Kent, Conservative, Thornhill, ON]

I'm looking at a document generated by Fasken, but a number of law firms have advised their clients. I'll quote the Fasken's advice, which says:

The coming into force of mandatory privacy breach notification, reporting and record-keeping in PIPEDA represents a sweeping change to the conduct of commercial activities in Canada. The rules will present new costs, risks and challenges for organizations, large and small, including in respect of legal risk management....

What's your office doing in terms of advising those who will be covered by the provisions of these new regulations?

[Daniel Therrien]

It's only since mid-April that we have known the content of the regulations, so it was difficult to give precise advice to organizations on how we would implement them. We're currently in the process of developing guidance now that we know the text. That being said, before the regulations were published, we were, and are still, in the world of voluntary breach reporting, and we have contacts, and we have conversations with organizations on the information that we think helpful when they report, currently voluntarily.

[Peter Kent, Conservative, Thornhill, ON]

Am I correct in believing the maximum penalty you have under these regulations is $100,000?

[Daniel Therrien]

I'll ask my colleague, Madam Bucknell, to speak to this issue. I think it is not the OPC that has the authority, but the amount seems right.

[Barbara Bucknell, Director of Policy and Research, Office of the Privacy Commissioner of Canada]

That's correct. The amount is $100,000, but it is not the OPC that issues the fine. It's a penalty, and we would have to refer it to the Attorney General.

[Peter Kent, Conservative, Thornhill, ON]

Now, I expressed the belief that $100,000 was a pretty trivial penalty for a significant breach violation. A member of the government on a television panel that we were participating in said that the $100,000 actually would apply to each of the individual violations. If there were 100,000 individuals affected by that breach, it would be multiplied. A possible penalty could be multiplied by $100,000. Is that correct or incorrect?

[Barbara Bucknell]

I've heard that as well. I think we'll have to get back to you with some more specifics on that.

[Peter Kent, Conservative, Thornhill, ON]

Would that be with regard to your reading of the detail of the regulations?

[Barbara Bucknell]

Yes.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up for seven minutes is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

Thank you, Mr. Therrien. We're very pleased to have you. We think we should have a special desk for you here, because you're at our committee all the time and we're using your advice consistently.

[Daniel Therrien]

[Inaudible—Editor] that's true.

[Charlie Angus, NDP, Timmins—James Bay, ON]

That's wonderful.

I am concerned about the transformation of the struggle over the privacy file over the last 10 years. Even as we update PIPEDA, this seems to be affecting many other elements.

I would refer you to a recent statement by the Bank of Canada, which normally doesn't weigh in on these matters. The deputy governor of the Bank of Canada, Carolyn Wilkins, said that they're very concerned about the effect on competition in the Canadian economy by the massive control of personal data by a few giant tech firms, mostly American firms. She stated:

Access to and control of user data could make some firms virtually unassailable. They can easily drive out competition by combining their scale with innovative use of data to anticipate and meet evolving customer needs at a lower price, and sometimes for free.

Would you consider it necessary that we start to advocate for more powers for your office to start to deal with the more diversified issues that are coming up with the growing data giants, whether it be issues of anti-competition or issues of privacy protection?

[Daniel Therrien]

The short answer is, yes, I would agree with the deputy governor of the bank. Although I don't think it would be appropriate for the Office of the Privacy Commissioner to review all of these issues, I think from the privacy perspective, the issue at hand, or one of the main issues at hand here with the growing centralization of powers in the hands of a few and the lack of authority or sanctions for actions that violate privacy, is the issue of trust.

If the digital economy is to grow, then consumers, citizens, need to have trust that when they engage in that economy, their personal information will not be sold or misused, and that there are sanctions. Others, such as the Competition Bureau, would certainly have a role to play in the issue of whether monopolies are created. Yes, I think new technologies raise very important concerns that I think have to be addressed through a number of laws and regulators with the capacity to share information and co-operate with one another.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

To that end, I'm concerned, and have heard from many people, about the new agreement that Rogers is putting on its consumers, saying that if you use their services, you're essentially agreeing to give them access to your personal contacts as terms and conditions of use.

In your view, would that be a breach of PIPEDA?