Evidence of meeting #103 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was work.
A video is available from Parliament.
9:40 a.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Mr. Kent.
The last questions go to Mr. Angus, for three minutes.
9:40 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Thank you.
This has been a very interesting meeting. I know we'll have many more interesting meetings.
I want to get back to the line of questions I was asking before in terms of defining the relationship of appropriate and non-appropriate, again with your predecessor. We spent a lot of time talking about gifts, but we didn't spend a lot of time talking about sponsored travel, certainly of a manner that could very much influence how a member of Parliament approaches an issue or how a member of Parliament votes.
Have you looked into whether or not we need clear rules regarding sponsored travel of MPs either by other countries that are lobbying Canada for foreign policy issues or by corporations that may have an interest? Have you started to look into that area?
9:40 a.m.
Conflict of Interest and Ethics Commissioner, Office of the Conflict of Interest and Ethics Commissioner
Not really, no. As you know, the code allows sponsored travel. It is perfectly okay, as long as it's properly declared. That's the decision that was made several years ago by the applicable House of Commons committee.
I think that this is a long-standing parliamentary practice and if it's done in the open—as it is, with our annual report, which we tabled at the end of March—frankly, I don't see any reason to change it.
However, it's a profound issue of parliamentary habit, if you wish, or a custom, or a culture.
9:40 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
I certainly agree. It's just that I remember our having spoken with your predecessor about whether or not a $50 gift should possibly be considered an influence, but if someone flies you around the world and puts you up in the best hotels and buys you drinks for two weeks, that's not an unacceptable gift.
It just seems to me that, if they fly me around Ottawa for the weekend and buy me drinks, I could be influenced, but if I'm doing it in another jurisdiction, I'm not. Should we clarify the rules?
9:45 a.m.
Conflict of Interest and Ethics Commissioner, Office of the Conflict of Interest and Ethics Commissioner
The way our system works, something is unacceptable if the law prohibits it. Parliament decides what is acceptable and what is not, and sponsored travel is acceptable.
9:45 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
What you're telling us is that you're putting the onus back on our committee to consider this.
9:45 a.m.
Conflict of Interest and Ethics Commissioner, Office of the Conflict of Interest and Ethics Commissioner
I'm talking about the other committee, on procedure.
9:45 a.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, everyone.
Thank you, again, Mr. Dion and Ms. Tremblay, for appearing. We appreciate your testimony today.
We'll have a brief break, while Mr. Therrien takes his seat. Thank you.
9:50 a.m.
Conservative
The Chair Conservative Bob Zimmer
I call the meeting back to order.
Thanks for attending, Mr. Therrien. I think we've seen each other several times over the past year, but welcome back. We'd like to hear your testimony for 10 minutes. Thank you.
9:50 a.m.
Daniel Therrien Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Good morning Mr. Chair and members of the committee.
Thank you for the opportunity to appear before you to discuss the OPC’s 2018-19 Main Estimates.
With me today is Daniel Nadeau, Deputy Commissioner of our Corporate Management Sector, and Barbara Bucknell, our Director of Policy, Research and Parliamentary Affairs.
In the time allocated, I will discuss, first of all, recent changes to our organizational structure, adopted with a view to streamlining our work and moving it towards a more proactive and hopefully impactful approach for privacy protection. Secondly, I will talk about the growing resource pressures associated with fulfilling our mandate.
As you know, our goal is to ensure that the privacy rights of Canadians are respected. The speed and breadth of technological advances have made achieving this goal increasingly challenging.
In the face of these difficulties, this year my Office has gone through a streamlining and forward looking re-organization exercise. It has sought to achieve streamlining by clarifying program functions and reporting relationships. It sought to be forward-looking by shifting the balance of our activities towards greater pro-active efforts, with the objective of having a broader and positive impact on the privacy rights of a greater number of Canadians, which is not always possible when focusing most of our attention on the investigation of individual complaints.
The approach, contained in our Departmental Results Framework, is explained in detail in our Departmental Plan tabled in Parliament two weeks ago.
Very briefly, going forward, our work will fall into one of two program areas, promotion or compliance. Activities aimed at bringing departments and organizations towards compliance with the law will fall under the promotion program, while those related to addressing existing compliance issues will fall under the compliance program.
We know that a successful regulator is not one who uses enforcement as a first or primary strategy to seek compliance. Our first strategy, therefore, under the promotion program is to inform Canadians of their rights and how to exercise them and to inform organizations on how to comply with their privacy obligations. Guidelines and information will be issued on most key privacy issues, starting with how to achieve meaningful consent in today's complex digital environment.
We also want to work with government and industry proactively in an advisory capacity, to the extent that our limited resources allow, to better understand and mitigate any negative privacy impacts from new technologies. By sharing information and advice during the crucial design stage of new products or services, we believe Canadians will be able to enjoy the benefits of innovation without undue risk to their privacy.
Under the compliance program, our strategy is to bring enforcement actions to ensure that violations of the law are identified and remedies are recommended. To this end, we will continue to investigate complaints filed by Canadians, but we will also shift towards more proactive enforcement. Where we see chronic or sector-specific privacy issues that aren't being addressed through our complaint system, we will proceed to examine these matters, for instance, through more commissioner-initiated investigations.
You have previously raised the question of whether we have sufficient funds.
While we have gone to great lengths to find efficiencies and make optimal use of existing resources of approximately $25 million, the growing importance of the digital revolution means we cannot keep pace.
There is also a difficult tension to manage between our complaints work and our proactive work. Both are important parts of our mandate, and we cannot effectively do both under current funding levels. You recognized this in your PIPEDA review report when you recommended my office have discretion to better manage its caseload.
The truth is, despite restructuring, there are insufficient resources, in particular to provide impactful advisory work. This is why I have asked the government for a measured increase in permanent funding above what is shown in the plan. This additional funding is necessary if we are to meet planned results highlighted in the Departmental Plan.
In particular, this would help us, one, provide organizations with more policy guidance on emerging issues; two, improve education for Canadians so they may take control of their privacy; three, shift more towards new, proactive strategies; four, assist our overwhelmed investigators in more expediently addressing complaints filed by concerned Canadians; and five, deal with mandatory breach reporting, which comes into force in November of this year but without any associated funding, and which, as was the case in other jurisdictions, is expected to significantly increase our workload.
In conclusion, in order for privacy protection to be truly effective and more than a pious wish, Canadians, of course, need modern laws, but they also need assistance from a regulator with the authority and the capacity to empower them with useful information, who can guide industry towards compliance with the law, and who can hold industry accountable when it is not compliant. We are doing what we can with the limited tools that we currently possess, but we are falling behind and we need additional resources to provide Canadians with the protection they deserve.
Thank you, Mr. Chair. I look forward to your questions.
9:55 a.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Mr. Therrien.
First off is Mr. Saini, for seven minutes.
9:55 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Good morning, Mr. Therrien. Thank you very much for coming with your colleagues.
I'm going to start off with a general question. As you're aware, we are now investigating the situation around Facebook. You were here I believe it was two weeks ago to provide your commentary. One of the things that you mentioned is that you are embarking on a joint investigation with your counterparts in British Columbia and the U.K. looking into AggregateIQ and Facebook. This is something that happened recently.
Obviously, this is going to consume a lot of your resources. Do you have sufficient resources to conduct a thorough investigation or will you be coming back for additional funding?
9:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
When an issue like this arises, and we're seized with a complaint as we are seized with the complaint, obviously, we devote the resources that are necessary to tackle that kind of important issue.
This complaint raises a number of very important, systemic issues that potentially will affect a great many Canadians. One of my points is, I want to give priority to work that affects the greatest number of Canadians. It's not that I don't want to investigate complaints that are case or individual specific, but if I have a choice to make, I must make the choice of undergoing work that affects the most people. That complaint, we will devote the resources necessary to. It may be that there will be a cost to pay elsewhere, but for that investigation, we will put in the money necessary to investigate it properly.
9:55 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
The second question I have is regarding your departmental results indicator. I read here that there's a rather significant decrease in the percentage of complainants responded to within service standards compared to the previous year. Can you explain why and are there any measures being taken to correct that?
9:55 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
There are two explanations for the two investigative groups. The explanation is a bit different in the two cases.
For the public sector investigative group, the Privacy Act investigative group, the increase in the time required to complete an investigation is, I would suggest, oddly enough good news in that we had a backlog of older cases that we have taken measures to tackle and we have now completed these investigations. This has the effect of lengthening the average response time for all of our work. Yes, the average response time under the public sector investigations has increased, but this is because the backlog of files older than one year has been reduced by roughly one-third, by 30% to 33%.
On the private sector side, there is also an increase, although that response time is generally a bit shorter than on the public sector side. That's a function of the number of complaints and the complexity of complaints. Given the fact that they are more and more technologically complex, that the business models we're investigating are more and more complex, it takes more time.
10 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Going back, in your 2016-17 departmental results report, you noted, “On the public sector side, the Office has noted a significant drop in breaches reported in 2016-17 (147 breach reports compared to 298 in the previous year)”, and that your office intends to follow up to determine the reason for this decrease.
Do you have anything to share about what you've discovered so far?
10 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have undertaken a review of this phenomenon. It is not quite complete, but we are almost at the end of the examination. We have been in touch with a number of departments. We are trying to ascertain the reasons for this phenomenon. The number of breach reports has increased slightly from last year, so it was at a certain point. It decreased drastically in the year you mentioned, and it has increased somewhat in the last fiscal year.
Our study essentially demonstrates that the number of cases reported is much lower than the number of breaches that occur and that the relevant Treasury Board policy is not particularly well understood by departments. We will report on that when we complete our study, and it will be part of our next annual report. But I can say at this point that this is of extreme concern.
10 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
I want to leave off with a very general question, because I think it's been an important one recently, with the Facebook issue and Cambridge Analytica.
In previous testimony you've said that outreach to Canadians, especially educational outreach, is extremely important. Looking at the situation that happened and at how many Canadians it has affected not just here domestically but more broadly around the world, do you find it important that there be greater outreach from your office, especially specifically targeting social media platforms?
10 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The short answer is yes. Our main communication tool is our website. We have quite a few people who consult our website when we're working on the practical usefulness of the advice that we give on our website. An important challenge is to bring more people to that source of information. A number of years ago, it used to be that consumer protection offices, for instance, would do ads in the media to raise the profile of a certain issue. Privacy has a certain profile; I recognize that. But there is an issue in terms of bringing people to the source of information that we have to offer, and I think that's part of the solution.
10 a.m.
Conservative
10 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Thank you, Chair.
Thank you, Commissioner. It's always good to see you here in committee.
In your opening remarks, you addressed the growing importance of the digital revolution, and you said it means that you cannot keep pace under the current budget of $25 million. With regard specifically to the expected costs of the Facebook, Cambridge Analytica, AIQ investigation, will you find it necessary to contract out investigative services with regard to what has been done and the range of conflicting explanations and untruths that we, at this committee, are coming across?
10:05 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Probably not. We will work in concert with our colleagues in British Columbia, the U.K., and other jurisdictions. That's one way in which we divide the work so that there is a certain distribution of work between data protection authorities. We have a solid number of experts. If there is a cost, as I said a few minutes ago, it would be the impact on the investigations that may affect fewer people.
10:05 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
In your search for the truth—again, given a variety of explanations, justifications, and probably mistruths—do you swear all of your witnesses when you take evidence in Canada?
10:05 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We do not do that as a matter of practice. I don't think we have ever done that in practice. Although we have the authority to compel people to testify, and to do that under oath, we usually receive co-operation from the organizations that we investigate, or the departments that we investigate. However, we have these powers, and I would not hesitate to use them if I faced a less than co-operative organization.