Evidence of meeting #147 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was companies.
A video is available from Parliament.
3:30 p.m.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Thank you for coming today.
We have a couple of different things to deal with today, including the estimates and a discussion about the joint investigation into Facebook and the Cambridge Analytica matter.
Mr. Angus.
3:30 p.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Just before we get started, I want to give the committee notice that I will be bringing forward a motion for us to discuss a possible summons of Ms. Sandberg and Mr. Zuckerberg from Facebook.
3:30 p.m.
Liberal
The Vice-Chair Liberal Nathaniel Erskine-Smith
Thank you, Mr. Angus.
With that, we'll have opening comments from our Privacy Commissioner.
3:30 p.m.
Daniel Therrien Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Good morning, Mr. Chair and members of the committee.
Thank you for the opportunity to appear before you to discuss the 2019-2020 main estimates.
With me today are Deputy Commissioner, Compliance, Brent Roman; Deputy Commissioner, Policy and Promotion, Gregory Smolynec; and Deputy Commissioner, Corporate Management, Daniel Nadeau.
In the time allocated, I will discuss some of our plans for the coming year and how we expect to make use of the new funding announced in the recent federal budget, which comes in recognition of growing demands on my office.
Our annual resources have been approximately $24 million in recent years. We hope to have your support in maintaining that funding.
We plan to use the additional resources to enhance our ability to deliver on our mandated obligations in the face of the exponential growth and complexity of the digital economy. Privacy issues are multiplying rapidly and often adversely affect Canadians' privacy. It has been an ongoing challenge to keep pace with those advancements and to protect Canadians in the way they deserve.
We require program integrity funding to enhance our capacity to protect the privacy rights of individuals and achieve meaningful results for Canadians.
Of course, we welcome the recent federal budget announcement of additional resources for my office as a positive step. It would allow us to take concrete steps towards implementing our proactive vision for privacy protection. I am using the conditional here because even though the federal budget has allocated sums to my office, we will only have access to those funds once Treasury Board has given its approval.
Part of the funding included in the federal budget is temporary, to help us deal with a backlog of complaints. While we have undertaken initiatives such as the increased use of early resolution and the revamping of our investigative processes, we have nevertheless struggled to respond to complaints in a timely manner.
We currently have a backlog of more than 300 complaints older than a year. The new funds would allow us to reduce the backlog to approximately 10% of its size by 2021. We would also be in a much better position to achieve our goal of meeting service standard targets in 75% of cases.
Ultimately, however, we think the best solution in the enforcement area is to modernize legislation, in part to give the OPC greater authority to manage its caseload according to risk. We need the discretion to focus our efforts on those cases with the greatest impact on Canadians.
The new funding will also be used to process privacy breach reports. Since mandatory breach reporting requirements came into effect in November 2018, our office has seen the volume of reports increase to more than five times what it was when reporting was voluntary. At present, we can only superficially respond to the vast majority of private sector breach reports to our office.
New resources would enable the OPC to more thoroughly review 40% of private sector breach reports to our office and 15% of public sector breach reports.
A third activity for which the federal budget provides additional funding is in the area of public education and guidance. The number of privacy issues for which parliamentarians, businesses and individuals require our advice and guidance is multiplying at a rapid pace.
In the past five years, requests for advice to Parliament have risen considerably, and this trend is expected to continue. Calls from various parliamentary committees are up 41% from five years ago, and in 2017-18 alone we made 34 parliamentary appearances and submissions. Clearly, privacy is becoming a very important issue for parliamentarians.
In the coming year, we will remain responsive to parliamentarians' requests for advice on the privacy implications of bills and studies, and we will seek to contribute to the adoption of laws that improve privacy protection.
New resources would also help increase our capacity to inform Canadians of privacy issues relevant to new technologies, their rights and how to exercise them. As well, we would be better positioned to guide organizations on how to meet their privacy obligations.
With current capacity, we can produce a maximum of three new pieces of guidance a year. Following our consent consultations a few years ago, we have developed an ambitious plan for much-needed guidance related to a wide range of important issues—guidance that we were asked by stakeholders to produce. Guidance to be developed over the next few years includes important issues such as biometrics, the Internet of Things, social media and de-identification, among others.
As well, existing advice and guidance needs to be updated to ensure that our website continues to be a trusted and comprehensive source for both organizations and individuals. There are over 150 guidance pieces on the OPC's website, approximately 40% of which are five years old or more.
Another important area for our office in providing guidance involves our advisory services to both industry and government. The new funding would help support our work with industry proactively in an advisory capacity to better understand, advise and help mitigate any privacy impacts at the design stage of their services.
Finally, I would add that guidance needs to be complemented by sustained and effective communication and outreach to have meaningful or significant impact on awareness and understanding of rights and obligations. We would therefore like to increase our capacity to conduct more public education and outreach activities to have a greater impact on awareness and understanding of privacy rights and obligations.
Of course, as you've heard me say before, our federal privacy laws require a number of very urgent reforms. As our recent Facebook investigation so starkly illustrated, we have reached a critical tipping point upon which privacy rights and democratic values are at stake.
I look forward to discussing those issues in an hour or so.
In conclusion, keeping pace with the rapid changes in technology is going to be an ongoing challenge for our office. We will continue to make optimal use of the resources given to us to carry out our mandate to have a greater impact on the privacy rights of Canadians. The recently announced new funding is an important interim measure and positive step towards achieving our targets as we await much needed legislative modernization.
Thank you, Mr. Chair. My colleagues and I look forward to your questions.
3:40 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you once again, Commissioner. I just wanted to give you a heads-up from the committee. I think it's been discussed amongst parties and members that we'll have one seven-minute round per party and then we're going to get right into the Facebook report, if that's okay with you.
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Sure.
3:40 p.m.
Conservative
3:40 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Good afternoon, gentlemen. Thank you so much for coming.
Mr. Therrien, I read the report here, which is your departmental plan for 2019-20. I just had a few questions on it, for clarity.
One thing was that there was a decrease here. Under departmental results and “Privacy rights are respected and obligations are met”, the target percentage of complaints responded to within service standards is 75%, but it's been going down. It was 68% in 2015-16, 55% in 2016-17 and 54% in 2017-18.
Is there a reason that's happening?
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think a major factor is the complexity of the issues that we are investigating. Often, they involve fairly complex technological issues, business models and technology. We have experts to carry on these investigations, but they are becoming more complex and that takes time.
3:40 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
When I look at some of the charts here, it says that the information is not available. Is that because you've only recently started to collect data?
If you look at the next lines, which are “Percentage of informal OPC recommendations”, “Percentage of Canadians who feel they know about their privacy rights“ and “Percentage of key privacy issues”.... Is it because you've just recently started to collect that?
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's because the the departmental results framework is new. The government has adopted a new policy on how to describe results for parliamentarians and that's what we have done. We are in the first year of the implementation of that process.
3:40 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Okay.
The amount of money you've asked for has gone up by about $5 million, if I'm right, from the previous year. Now, as I read the report, you have now a mandatory breach reporting provision. Has that caused this increase, this backlog, because now, rather than voluntarily, people or organizations have to mandatorily—
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's one of the reasons that we're facing a higher volume. In particular, if you look only at breach notifications, previous to November, organizations could voluntarily report; now they have to when there's a material breach. The volume of these reports has increased fivefold since November. That's clearly a reason for the increased volume. It's not the only one, but it's an important one.
3:40 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
With regard to the increased funding you've asked for, I see here that you have planned to keep the human resources or full-time equivalents the same. Would you not need to hire more people to deal with the backlog?
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We will. Currently, we have roughly 180 FTEs. We have around 195 individuals, but not all of them work full time. With the new funding, we will likely hire roughly 30 more people.
3:40 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Okay.
As you know, obviously, the last time you came here you gave us an update on your inquiry into Facebook. That inquiry itself must have consumed a lot of resources. Did you apply the same resources to that issue or more resources to that issue?
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We clearly applied more resources to that investigation than to an average investigation.
3:40 p.m.
Liberal
3:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes. There was not only Facebook. Facebook was a very important investigation in the past year, but Equifax was also an important investigation, and there were a few others. We need to look at these issues thoroughly. They affect a large number of Canadians. That's the result.
3:45 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Thank you.
I'll pass the rest of my time to Mr. Erskine-Smith.
3:45 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
I have just one question. You spoke about the rapid advance of technological change and seeing more resources spent in the last year on larger investigations. You mentioned a couple of them just now. When you look ahead—you see an increase in resources in this past budget, and I know you welcome that—is there a number that you would suggest this committee recommend to government to say, “If we receive this amount, we could accommodate the existing caseload and we would also be able to accommodate what we expect to be the workload going forward”?
3:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In terms of the volume of complaints, I see the federal budget as bridge financing, allowing the OPC to function and to dramatically decrease the backlog in the next two years or so. My hope, certainly, is that by that time, there will be new legislation. It's a bit premature to say at this point how many resources would be required to implement a new system that has not yet been defined.
May 7th, 2019 / 3:45 p.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Thank you, Mr Chair.
Commissioner, thank you for being here this morning. My colleagues were very inspired and they asked several of my questions.
From an optimistic perspective, given the increase in the number of complaints, do you think you will be able to stabilize the OPC budget, or should we expect these additional amounts to become permanent over the next three or four years?