Information & Ethics Committee on June 14th, 2016

[Lisa Austin]

My understanding is that this was a recommendation pertaining mostly to the question of order-making power. The Newfoundland model was a hybrid model, and the hybrid model had much to recommend it over an order-making power.

I would say that I don't have a firm view on that particular debate, except that I lean heavily towards the order-making power. I would encourage you, in thinking that through, to take the perspective of the individual rights holder here in terms of privacy, and ask which is going to be better for them in terms of which of these models puts more of a burden on the individual to go to court to vindicate their rights rather than have it dealt with in this other process. We have an access to justice crisis here, and putting burdens on individuals to take it up in court when they are supposed to have these robust rights is, I think, unrealistic. Recommendations from the past that have focused on courts just don't take that into account. That's one thing.

The other thing is that the debate seems to involve a lot of hand-waving and anecdotal evidence. We have multiple jurisdictions in Canada that have different ways of doing this. In Ontario there's order-making power. In B.C. there's order-making power. If there are questions about whether that changes the dynamic by shifting away from an ombudsman model or whether it makes for a more contentious relationship with the government, certainly there are jurisdictions you can get evidence from. This could be a more factually based inquiry. You can take a look at what's going on in those jurisdictions and find that out.

The only other thing I would say is that in these charter contexts that I'm extremely concerned about, having a strong stick is good, because in these charter contexts, the individual is in a conflicting relationship with the state, whereas in the more administrative context, where the state's administering a social program, there's not that strong conflict. There's some conflict, but it's not that fundamental conflict.

I do think that from that perspective, order-making power has a lot to say for it, but I don't have a definitive view.

[The Chair, Conservative, Blaine Calkins]

That was a very lengthy answer. It turned a five-minute round into a seven-minute round.

We'll go to Mr. Saini, please, and I'll try to extend the same courtesy.

[Raj Saini, Liberal, Kitchener Centre, ON]

Good morning. Thank you very much for coming here.

I have one general question, and then I will get to a specific question.

My first general question is that as you know, the government is instituting a computer system called GCDOCS across 17 departments. If one department collects information that they require and need, how do you prevent the other departments from accessing that information about Canadians when it will be on the system for 17 departments to view? Do you have any kind of recommendation?

[Teresa Scassa]

I don't think I know enough about the system specifically to know what kind of access is forecast, but there are technological ways, even within a large shared database, that you can create different levels of access for different persons or parties that have access to that database. I'm not sure if one of the measures that is being contemplated is to create those different levels of access to manage access within the database.

[Lisa Austin]

I will go back to some of the earlier remarks I made: you can't think of safeguarding privacy just in terms of the administrative processes for sharing information; you have to look as well at the technical systems that we're building. You have to think about it at that level, so that you know how to build those systems and you can put in the safeguards that you should have a legal obligation to have. It's difficult to bolt them on after the fact. It's possible, but it's usually expensive and difficult.

You think about it up front. When you are building processes, you need to think about privacy up front. You think about compliance with the charter up front, and you build it into the technical apparatus that you construct up front.

[Raj Saini, Liberal, Kitchener Centre, ON]

The second question I have is based on national security.

As you know, Canada has many alliances around the world, whether it be the Five Eyes or intelligence sharing with our European partners. I'm wondering if you could give me an idea, because I'm not sure if I understand how it works.

From a foreign government you may have two types of requests. You may have an immediate request when there's an ongoing situation in a foreign country and they need some information on a Canadian, or you may have a long-term request for information on a particular Canadian who is not involved in anything immediately, but could be down the road. How do you analyze that request? More importantly, how do you safeguard the information? Once it crosses a border, that information now is being held in a foreign government's file.

We have the Privacy Act and we have certain safeguards here. How do we ensure that those same safeguards will be maintained in a foreign country, or that the information will not be shared within the departments of that country or sent off to a third country?

[Lisa Austin]

That's a great question. I would emphasize the need for safeguards, which is an issue that is coming up in charter jurisprudence. That is partly why we are arguing for an improved accuracy obligation in the Privacy Act itself to set up some obligation to get those assurances.

I think what you need in these alliances and these international contexts is to protect each other's citizens through treaties that agree to extend certain kinds of rights. Then you have audit processes under them, so that people can go and take a look at the information practices. I don't think you can solve that through a privacy act.

[Raj Saini, Liberal, Kitchener Centre, ON]

You would need some sort of super national treaty, because the problem is that each country has a different regime. If we ask them under our regime, another country may have a stronger regime. You would have to create one framework that every country would have to adhere to. Is that something that you're suggesting?

[Lisa Austin]

That might be the answer. It might be, at least among allies, that you create some international regime for doing that. I know there's a lot of interest in how to deal with the MLAT process in the evolving world.

There are various models. I don't know what the right one is, but it does seem to me that it's some kind of international agreement, or at least super national in some way. In Privacy Act reform, you can tweak it and start getting at some of these obligations and you can create agreement, but you do need something stronger than that.

[Raj Saini, Liberal, Kitchener Centre, ON]

Mr. Chair, do I have some time left?

[The Chair, Conservative, Blaine Calkins]

I'm going to be gracious. Go ahead, please.

[Raj Saini, Liberal, Kitchener Centre, ON]

Let me ask this question to Mr. Lyon, because he has been sitting there patiently and I want to include him in the conversation.

You talked about surveillance. If a foreign country asks us for information, asks us to surveil one of our own citizens, how does that work? Can you give some commentary as to what the process is, what we should be allowing to happen, and what we should prohibit from happening? How should the rights of Canadian citizens be protected, while being a partner to an international country, to make sure that information is still being properly disseminated?

[David Lyon]

Do you have a national security or law enforcement regime in mind here? Is that the situation?

[Raj Saini, Liberal, Kitchener Centre, ON]

No.

Let's say a foreign country asks us to surveil one of our own citizens for whatever reason, whether it be a national security question or something else. How do we deal with that? What parameters do we have?

I know Madam Austin mentioned that there's a warrant process, but how do you do that, especially if it's an immediate request?

[David Lyon]

This is not an area that I deal with specifically, but it does seem that there needs to be a lot more oversight of the agencies that might be involved in receiving and sharing that information. That seems to me to be a critical issue.

How the actual mechanism would work is not something I'm privy to or know about. It does seem to me, though, that we need a lot more oversight on those agencies that are concerned with law enforcement and security matters, because that's where the issues arise and where things become very murky.

[The Chair, Conservative, Blaine Calkins]

Thank you, Raj. Much appreciated.

We now move to Mr. Kelly for up to five minutes, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

Professor Lyon, in your earlier remarks you mentioned what I took to be a description of a deficiency in understanding all the issues around privacy and how to address them. I think you suggested that we wouldn't be ready yet for a complete overhaul of the act and that there was a substantial need for additional study into privacy matters. I think you even suggested a royal commission of some type, or some type of large-scale study.

Could you identify the things that we don't know? What do we need to research, and what areas require more study before a proper rewrite could be done, in your opinion?

[David Lyon]

There are things that we have already been talking about.

In a sense, they can be talked about in terms of technological changes and the new kinds of means of finding out about individuals for one purpose or another. There are things I mentioned in terms of the trends toward a greater use of biometrics, and sensors being embedded in buildings, streets, vehicles, and so on. A lot of it sounds like coming to terms with the technological changes that are already occurring. That seems to me to be crucial.

On the other hand, I've been trying to stress the ways in which the very idea of privacy has altered since the 1980s, when the act was originally conceived. It seems to me to be essential that we bear that in mind as well. This comes into, or is completely consistent with, what Lisa Austin is saying about the need for charter compliance here.

It seems to me that the notion of privacy was once conceived in a very atomistic and individual way, and it had to do with very specific harms that could be identified. In today's situation, we have to think about a much broader range of issues that have to do with democratic participation and human rights, so the very notion of privacy, it seems to me, needs to be expanded.

It's both things: it's coming to terms with the real technological changes—and again, big data is a huge issue here—on the one hand, and it's also understanding how the notion of privacy has itself evolved into a much more social and participatory matter than was thought of in the Privacy Act originally.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

In a completely different vein, Ms. Austin could perhaps address this one.

What would be involved in expanding the judicial recourse and remedies under section 41 of the act that the commissioner has recommended? Would implementing this recommendation increase or decrease the expense of staff requirements for the courts? Would this increase or decrease liability settlements and damage costs to the treasury? What would be the net result of that recommendation?

[Lisa Austin]

That's the bottom line. You should never ask academics questions about the bottom line.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I might have done that on purpose.

[Lisa Austin]

The point about increasing the judicial remedies is that one of the big defects in the Privacy Act that the Privacy Commissioner points to is that the provisions around the collection, use, and disclosure are ones that you can't take to court. You don't have recourse there, yet those are increasingly vital in safeguarding information in all sorts of contexts, whether they be administrative, national security, or law enforcement.

It's absolutely vital that we have something there. Is it going to cost more? Probably, but I would say, again, that recourse an important aspect of protecting privacy rights. Without that, you can't make the Privacy Act work in the context that it's being asked to work in.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I'm not suggesting that cost be a reason not to do it. I just simply wanted an idea—

[Lisa Austin]

—what those costs would be. Sorry; I wouldn't know.

[The Chair, Conservative, Blaine Calkins]

Mr. Long, you have up to five minutes, please.