Information & Ethics Committee on Nov. 1st, 2018

[Daniel Therrien]

You've described a number of situations. Consent is certainly a fundamental principle of PIPEDA, in the relationship between consumers and commercial organizations. However, as I said in my opening remarks, I think it would be useful to consider whether consent, given the complexity of technology and business models, will always offer a meaningful privacy protection, or whether we should look at other mechanisms, such as legitimate interest under the GDPR. That's for the commercial sector.

With respect to the public sector, consent is not as fundamental. It is an element, but there are a number of situations where the government can require, from an individual's data, personal information for service delivery. If I put the two together, the use of information either to deliver government services or to offer services for a company, I think it's important to recognize that data can be useful to either the public or the private sector to offer better services.

The issue is how to properly manage that information and—very importantly, from my perspective—have the right legal framework to ensure that the actors, whether it's government departments or companies, handle that data in a responsible way. It should also ensure that there is a third party, currently my office, with powers to protect individuals, because individuals will not be able to protect themselves completely when facing large corporations or large departments.

I'm not against the collection, use and sharing of information to improve services, but I think that our current frameworks in Canada are lacking.

[Peter Kent, Conservative, Thornhill, ON]

Would you consider that this sort of request should at least take into account the consent aspect? In other words, a great many Canadians, as we've seen across the country, have reacted to this breaking story with outrage that their most personal financial secrets, if you will, attached to their SIN numbers, would be collected without their consent.

[Daniel Therrien]

Statistics Canada is arguing that they can do this without consent based on the current legal framework. Because we're besieged with complaints, my obligation is to consider these arguments, consider what complainants will say and come up with a conclusion.

[Peter Kent, Conservative, Thornhill, ON]

We don't know what system they are using to collect the data, to hold the data, and to anonymize the data, whether it's just by attaching a code number, but if they're going to use it in the way that has been described, it would seem that as long as they have that data, it is accessible to a potential breach. A breach of this sort, of deeply personal financial information, could have political overtones in terms of the way it might be used if that information was not successfully held.

[Daniel Therrien]

I put it in terms of the legal principles at stake. Financial information is sensitive; therefore, it is deserving of a higher level of security safeguards. We have not looked at the security safeguards put in place by Statistics Canada, but as a matter of principle, the nature of the information in question would require a high level of security safeguards.

[Peter Kent, Conservative, Thornhill, ON]

Do we have any idea which technology company would be employed by Statistics Canada?

[Daniel Therrien]

We'll find out when we investigate.

[Peter Kent, Conservative, Thornhill, ON]

We don't know whether Google might be the data collecting or data—

[Daniel Therrien]

I doubt it, but we will find out soon.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Next up for seven minutes is Mr. Davies.

[Don Davies, NDP, Vancouver Kingsway, BC]

Thank you, Mr. Chair.

Commissioner, you have provided an exceptionally clear and profound description of the fundamental role of privacy in a democracy. You've used terms like “crisis point”. You've said that the lack of protection puts the public trust at risk; that citizens' personal information has been weaponized; that this leaves our elections open to manipulation and it jeopardizes the fairness of elections. You have said that parties are at the centre of data collection. Of course, you've also mentioned that 92% of Canadians want political parties subject to privacy laws as the prime actors using that information, yet this government has refused to apply privacy laws to political parties.

Have you heard of any persuasive reason offered by government for why privacy laws would not be properly applied to political parties, in terms of protecting the privacy of the information they have?

[Daniel Therrien]

Going back to the context issue that we discussed a few minutes ago, I've heard the argument that political parties need to be able to have some freedom to communicate with electors as part of the democratic process leading to a party being elected.

If we look south, for instance, in the United States, these kinds of arguments actually have a constitutional foundation at the level of principle. But as a matter of practice, is the communication between parties and electors impaired because privacy laws apply to political parties? From a practical, concrete perspective, we know of a number of jurisdictions where political parties are subject to privacy laws, and in these jurisdictions no one is saying that subjecting parties to privacy laws has, in effect, impaired the quality of the discussion between parties and electors.

Theoretically, perhaps, there is an argument that can be made, but on the ground, it has not been borne out where these laws apply, and I have not seen evidence—although I hear the argument and it's an interesting argument—that the quality of the communication would be impaired if political parties were subject to privacy laws.

[Don Davies, NDP, Vancouver Kingsway, BC]

Mr. Baylis touched on this. Of course, British Columbia, the province that I come from, does in fact subject political parties to privacy laws. Are you aware of any diminution in the democratic ability of parties to participate?

[Daniel Therrien]

No.

[Don Davies, NDP, Vancouver Kingsway, BC]

You have pointed out context, I think, quite properly—that there are differences in context between commercial and political purposes—but I'd like to focus on the similarities.

Businesses are selling a product. Political parties are selling a candidate, a platform. Businesses are selling a widget and are seeking money to purchase their widgets. Political parties are seeking donations. They're both advertising.

Appreciating the context, is there any principled reason that privacy laws that do apply to private actors should not apply to political parties?

[Daniel Therrien]

I'll repeat that there is this argument made about the quality of communication, but I, at least, have not seen evidence of an impairment in the quality of the communication between parties and electors.

[Don Davies, NDP, Vancouver Kingsway, BC]

I want to read from a political party's website, I won't tell you which one. It says this: “It is also possible that your information could be provided to us by a volunteer or friend who thinks you would be interested in getting involved with [the party].” Would that respect any privacy law or consent regulations currently in force in the country with respect to the consent principle?

[Daniel Therrien]

Let's look at this example. It's an interesting example. If you apply privacy law, strictly speaking, consent has not been obtained. Therefore, the party in question should not receive the information. But in order to have a communication between a party and an elector, I think I'd be interested in looking at that situation, the first communication. A friend says to party A, my friend B may be interested in hearing from you. So the party has information about friend B. One of two things happens: Either friend B says, “Yes, I'm interested”, and then the communication continues; or friend B says, “I'm not interested”, in which case I think a proper application of privacy laws would have the information being set aside and the communication stops.

The first part of the sequence may be an example where context may lead to a different application in terms of the outcome, even though the privacy principles would apply.

[Don Davies, NDP, Vancouver Kingsway, BC]

It asks whether you'd be interested in getting involved with the party; it's not asking to be contacted. Does that change your concern at all?

[Daniel Therrien]

No, I think what I've said would apply.

[Don Davies, NDP, Vancouver Kingsway, BC]

We heard a reference to the information that Sidewalk Labs' controversial waterfront smart city project has created some concerns. We've heard that Ann Cavoukian, the Ontario privacy commissioner, resigned from her advisory role over her concerns about privacy protection.

Has your office been looking at that project, Commissioner? Are there any privacy concerns on your end that you're investigating?

[Daniel Therrien]

We have been in touch with Sidewalk Labs under a new advisory program that we created a few months ago as a way to bring companies to comply with PIPEDA, in this case. We want to work with the willing and have discussions on how best the company may bring about an operation in a way that is PIPEDA-compliant. We have had a number of conversations, which at this point are still at a very high level of generality. We are engaged in this process. We've not gotten down to the level of concrete details where I could say whether I am concerned or not. It's at a very conceptual stage at this point.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Davies.

Last up, for seven minutes of shared time, we Mr. Picard and Ms. Fortier.