Information & Ethics Committee on Sept. 27th, 2016

[Wayne Long, Liberal, Saint John—Rothesay, NB]

I know that in 2010 there was an instance of medical records being faxed to the wrong place, and you made a recommendation about that. In 2013, it was still happening. Obviously, you were quite frustrated. You didn't have any non-binding recommendations. Could you elaborate, maybe not just in relation to that case, on the fact that you really didn't have order-making power?

[Gary Dickson]

There are some interesting things. If you don't have order-making power, you spend a lot of time thinking about how you can persuade government institutions to do a better job in terms of protecting privacy. I think it puts a premium on creativity, imagination, and some relationship-building, because there's not much sense in writing reports that have all kinds of nice recommendations if there's little prospect they're ever going to be realized.

This ties back into my earlier comment about the need to always ensure that commissioners' offices are being responsive and are accessible to Canadians, and then that they have the appropriate power to be able to ensure remedial action is taken when warranted.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Long.

We have our last question in the formalized part of the round going to Mr. Blaikie. Then if there are any other MPs who would like to ask some questions, we have some time at the end.

Mr. Blaikie, take us away.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

Professor Bennett, you mentioned that when it comes to PIAs, they can be more effective if they are done earlier in the process.

Is statute the way to try to embed those things earlier in the process? Is it through Treasury Board directives? How do you put those privacy impact assessments at the front end?

[Prof. Colin Bennett]

The PIAs have been embedded in Treasury Board guidance. My understanding from the Privacy Commissioner is that some departments do a lot of PIAs, while others do very few. They vary in quality a lot.

I did some analysis of PIAs a few years ago, and my conclusion was that they're virtually useless if they're just a statutory checklist to determine if something is legal. They're far more useful when the implications for privacy are considered in a broader context beyond the law and when agency officials are invested in the process of doing that analysis in a recurring way.

The analysis is submitted to the Privacy Commissioner, who gives some feedback, but the understanding is that if there are any subsequent changes to the program, the PIA itself has to be adjusted as a result. That's the kind of early warning system that I think produces an ounce of prevention, and should, in that perfect world, mitigate the chances of data breaches. It should encourage privacy by design. It should encourage the building in of protections at the outset of program development and service delivery, rather than putting them on at the end.

There are plenty of examples in Canada of very good PIAs that fit that model, including some that have been done in the area of border services, but so often they are brief checklists.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

I guess part of what I'm asking is obviously about the element of organizational culture there. We're reviewing the laws because there's something that should be in the law or changed in the law that would help or facilitate that organizational change, or is it really Treasury Board having to do that hard work of...?

[Prof. Colin Bennett]

I think there are certain models. Increasingly, privacy impact assessments are included within statutory provisions. They're included, for example, in the new general data protection regulation of the European Union. It's something that all European countries—their organizations there—have to do under most circumstances. It's good organizational practice, but unless it's formalized in law, experience is going to vary and quality is going to vary, and that, I believe, has been the experience of the Privacy Commissioner.

Under Treasury Board guidance, some agencies take that responsibility seriously, others less so. That's why I support his suggestion that you craft some language into the Privacy Act that mandates organizations to do PIAs and consult with the Privacy Commissioner when there are real, substantial risks to privacy.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you.

[Prof. Colin Bennett]

It would formalize what should already be done under TBS guidance.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Blaikie.

Go ahead, Mr. Bratina.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

One of the most difficult words or concepts in creating legislation is “discretion”.

Monsieur Drapeau, you mentioned recommendation 13, “Provide the Privacy Commissioner with discretion to discontinue or decline”.

Could you remind me of your comments again on that item?

[Col Michel Drapeau]

In fact, I'm opposing that particular recommendation. The Privacy Commissioner would have the discretion to refuse to investigate a complaint because he would find it frivolous or repetitious or whatever. He would find it, in fact, not to be in accordance with what he would define as a reasonable complaint. I say if you do that, you're talking about a quasi-constitutional right of the individual to use the Privacy Act and to lodge a complaint. It's a human right.

Behind closed doors and in camera, given this discretion, the Privacy Commissioner would deny this individual not only to write a complaint but, if he were to exercise his right to a remedy before a court of law, he couldn't get there. I would oppose that. I'm well aware in some provinces that some of the commissioners have this ability.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

There is frivolity and vexation in the world. How would you deal with that?

[Col Michel Drapeau]

For 33 years, the Privacy Commissioner has had some of these complaints, and no doubt there have been some complaints that might have been frivolous. Some of those presumably won't get the investigative attention, detail, and resources they would otherwise have.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

In football, the referee used to have complete discretion. Now we have instant replay and challenge flags, and it seems to be screwing up the game sometimes, so sometimes discretion has been a good thing.

Let me go on to your four-year journey in the complaint that you lodged.

Is there a general way you could speak to our committee on this aspect? You must know so much about this and know where the pitfalls are and why this thing is dragging out. Is there any help you could give us on that one?

[Col Michel Drapeau]

I think that over the years, the investigative process of privacy has become more and more cumbersome. Maybe more and more the world is designed this way, and we have more procedural fairness. Be that as it may, we now have an investigative process that takes a long time. My suggestion is we don't want to make it any longer than what it actually is, because if you're going to make a complaint, it's a human rights complaint and you want to be sure that you have some form of remedy or some form of resolution as quickly as possible.

Most of the complaints don't go four years, but there are a number of complaints that go to two and three years. Is it an absence of resources? Is it a prioritization of the complaint? I don't know where the problem lies; I really don't, but I'm concerned that it's taking this long. As we speak, there is a 1000- complaint backlog in the privacy office. It will take at least a year before an investigator is assigned to investigate them and come up with some findings and recommendations, so there's a problem even within the existing system. To add order-making powers, as Justice LaForest would have it, is not only expensive but time-consuming, and it's akin to a court proceeding. My comment to you is that the current investigative process at the Privacy Commissioner's office is, in fact, currently longer than most court proceedings.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Resources are an issue. Should we be prioritizing requests? We have international questions and so on, so on the basis that Canadians need service first and given the slow backlog that we've heard about, should some requests be delayed in favour of others?

[Col Michel Drapeau]

Before we go there, we must make sure that we don't load up the Privacy Commissioner with any task that is not essential to his basic function. His basic function, as it is set out in the Privacy Act, is the investigation of complaints. That's what it is, and that's one of the reasons I basically object to providing him with a function to do public education and research. That could be an open-ended task that will, in fact, draw resources away from his investigative function. His primary role is the investigation of complaints, and that's where the bulk of his assets ought to be.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Mr. Dickson, did you want to comment?

[Gary Dickson]

I'd just make this observation. Of course citizen complaints are important, and you have an obligation to do those in a timely way as an oversight office, but if you also have the opportunity to provide input on a new piece of legislation or a new program that may impact hundreds of thousands or millions of Canadians, surely there's high value in that.

Although this office was probably originally conceived as focused almost exclusively on dealing with individual citizen complaints, over time it's evolved so that a substantial and, I think, a critically important part of the mandate is providing advice and commentary to government public bodies when they're developing new technologies, legislation, and programs that may be privacy invasive. I think that's as legitimate as the complaint processing.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Mr. Bennett, would you comment?

[Prof. Colin Bennett]

The accumulation of complaints, of course, can lead to an understanding about systemic problems, and good commissioners will be able to do that.

I understand what my colleague is saying about the frivolous and vexatious exemption. On the other hand, there are people who do abuse this legislation and put in an extensive number of complaints over and over and over again. We had to deal with this in B.C., and the commissioner there decided to prioritize complaints—to answer your question—by saying that any one person might only have three active complaints going at any one time. That sort of solved the problem.

I do think there should be a public education mandate, a public research mandate. It's already done. It's done under PIPEDA, and if it's done under PIPEDA it's very difficult to distinguish between a private sector issue and a public sector issue these days. The Privacy Commissioner has a very effective contributions program and gives out money for research, which is very valuable in terms of finding out about new technologies and new practices. That is done for public and for private sector issues, so it's very much a question of formalizing what has become the practice of the office over the last 10, 15 years.

[Col Michel Drapeau]

We may want to look over the past 10 or 20 years, say, at what the percentage has been for investigative resources and whether this number, as a fraction of the overall resources—monetary and personnel—has been diminishing. I think it has been, and as a result, as complaints may increase through time, if we devote fewer investigative resources to attack it, then many complainants will just stand aside and will not file a complaint because they know from the get-go that their complaint will not receive the kind of attention it deserves if they have to wait two years or three years for it to be addressed. That's not a solution, and at the moment I think we are there.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Bratina.

Go ahead, Mr. Saini.