Evidence of meeting #147 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was companies.
A video is available from Parliament.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
There is no question that it could happen today.
Liberal
Anita Vandenbeld Liberal Ottawa West—Nepean, ON
That's not just on Facebook but on other platforms as well.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It could. I haven't investigated others, but I assume that what is happening on Facebook may be occurring elsewhere, but certainly with Facebook, yes.
Liberal
Anita Vandenbeld Liberal Ottawa West—Nepean, ON
I would imagine that there is a lot of urgency in terms of our need to be able to legislate so that you can have those kinds of powers.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
Liberal
Anita Vandenbeld Liberal Ottawa West—Nepean, ON
Going to the Federal Court obviously would allow penalties, but your estimate is that would be another year. It would add a lot of time, and then we wouldn't be able to have that kind of urgency in terms of your investigations. Is that correct?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It would take a year. After a judgment by the Federal Court, I think we would be in a much better position, but I'm not sure that the legal proceedings would stop at the Federal Court. I think what is at play is sufficiently near to the business model of the company that it is likely this matter would reach the appellate court level, so it's going to take some time.
Conservative
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
I found your last statement interesting. We certainly won't get to the Court of Appeal overnight. We're looking at a 10-, 15- or 20-year horizon.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Five years.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
That's rather optimistic.
Canada is really the Far West when it comes to the digital landscape and its regulation. We want to do something, but what? Are there countries that have chosen collective action or more or less common legislation with other countries, which could send a signal to Facebook and to other large companies to incite them to develop a framework?
Canada can try something. It may be sued. There may be winners and losers. Other countries will be watching. Do you think every country will adopt measures, individually, at the same time? Will the laws ultimately be similar?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I don't think we will see an international treaty any time soon, either.
If different countries adopt similar or interoperable laws, the multiplication of those legislative and regulatory measures could lead to results. What's encouraging, as you know, is that Europe has already passed regulation that provides some solid privacy protection. It came into effect about a year ago.
I'm encouraged by the fact that serious discussions are now being held by the American Congress to adopt privacy protection legislation. When our trading partners in Europe, the South and several Asian countries go in the same direction, there is reason for greater optimism but it's taking a long time.
Ultimately, the adoption of stricter laws in various countries, some of which are Canada's trading partners, should improve things.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
I believe that Canadian legislation would be more restrictive with regard to Facebook than American legislation. In the American system, Facebook must give a lot of money to members of Congress. There must be pressure to ensure a certain amount of leeway and freedom in reality. However, the political systems of countries such as the United Kingdom, Canada and Australia may provide an opportunity to take things a little further.
You've adopted a strategy of taking small steps, and that's fine for you. However, should we, the legislators, work with four or five countries to test the system properly? Otherwise, one country will act, and other countries will observe what happens and then make adjustments one after the other. Is the best approach to wait for one country to act and then make adjustments as the initiatives unfold, or to ensure that the countries take stronger measures? The latter approach would send the message that recess is over.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
All countries must act, without waiting to see what their neighbours will do. We're back to the initial point of the conversation, which is that technology and business models are evolving very quickly. We shouldn't think that if the legislation is amended in two years, it will be effective for the next 20 years. The legislation must be effective when it's passed and flexible enough to take into account technological changes. Parliamentarians must also keep an eye out for these changes and must act quickly when the legislative framework shows weaknesses in this area.
In today's world, technology is changing at an incredible rate. The legislation isn't keeping up, and that's a major issue. I'm not asking for the legislation to be amended every six months. However, we must establish a framework that's flexible enough to take into account technological changes, while keeping in mind that it may be necessary to legislate five or eight years down the road because of the speed of these changes.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Our legislation must be very progressive and proactive.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, exactly.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Do you want the government to make it a priority in the future?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Absolutely.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
If the legislation isn't a priority, it may be postponed. However, if the legislation is a priority, things may move faster.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
What could be a more serious consequence for a society than business practices that undermine the integrity of the democratic process? This is the first of several reasons to take urgent action. The new Parliament should make it a priority to legislate on these issues.
Liberal
Mona Fortier Liberal Ottawa—Vanier, ON
Thank you, Mr. Chair.
Thank you for joining us, Mr. Therrien.
The questions are starting to become repetitive, and I hope that I won't make you repeat yourself.
We're obviously discussing a complex matter. We must find a way to monitor developments on this issue.
You've already answered a number of my questions. In your presentation, you said that it was time to reform the legislation. I think that's clear. You said that the legislation should require demonstrable responsibility, which would be similar to accountability. You've probably done so, but could you briefly explain what you meant by that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
In the current legislation, the first principle is referred to as “accountability” in English and “responsabilité” in French. As I understand it, the term “accountability,” in an accounting sense, means a “reddition de comptes.” In other words, it means that the responsible party must report to its constituents on how it has carried out its responsibilities.
In the current PIPEDA, the term “accountability” is referred to as “responsabilité” in French. Responsibility ends before accountability. It's already a lot, but it ends before accountability. Responsibility consists of adopting procedures to implement the other principles of the legislation, including consent, openness and access.
The company or organization fulfills its obligation to take responsibility by adopting procedures. However, the company or organization isn't accountable, either to users or to the regulatory agency, when it comes to demonstrating that the procedures implement the PIPEDA principles.
One consequence of Facebook—and there are other signs of this—is that it can no longer be trusted. The principle of accountability is important. Companies must take responsibility, and the entire privacy burden mustn't be placed on users. It would be unrealistic to think so. Companies must take responsibility.
The case of Facebook, for example, clearly shows that the fact that the legislation imposes a responsibility doesn't mean that the obligation will be fulfilled, hence the need to require accountability. Companies must be required to show that they've adopted procedures to implement the principles of the legislation, while providing proactive inspection powers.
Under one model, companies would provide a report to the regulatory agency on the procedures that they've adopted. The reports would be similar to the privacy breach reports, which have been a legal obligation since November.
Imagine legislation where companies must provide a report to the regulatory agency on the procedures that they've implemented to fully comply with the PIPEDA principles. The regulatory agency, which has limited resources, would review the reports and note issues in certain places. It would inspect the companies, and perhaps it would find violations and penalize the companies.
If responsibility were to lead to true accountability,
a real accountability in accounting terms,
it would eventually have an impact on the entire industry, because companies wouldn't want to run the risk of being inspected and penalized.
