Thank you for the opportunity to respond.
The question you asked is not much different from the question that would have been asked more than 30 years ago when legislators and parliamentarians were looking at trying to create a regime that would provide adequate protection for the privacy of Canadians, yet at the same time allow the necessary collection, use, and disclosure of personal information to keep people safe and to deliver services that your constituents and all Canadians require and expect.
There was a royal commission in Ontario in 1980 that produced a seven-volume report wrestling with that very question. We have certainly the experience of over 30 years with legislation.
I think the way we try to address and meet this constantly changing world of threats and challenges and so on to personal privacy is flexibility and comprehensive protection. For that you need legislation that's adequate to the task, which is the exercise you and your colleagues are currently engaged in. It means having a privacy oversight agency or, as Colin would say, a data protection agency, that has the necessary flexibility to be able to deal with changing threats and constantly changing new privacy-impacting technology.
The other thing that is always important to recognize is that it's never only about the statute. I like to think we have a privacy regime that's composed of a number of components. One is what you're currently engaged with, looking at the statute, but I think we make a huge mistake to focus only on the statute. In many respects, you can have a South African statute, which is one of the best in the world, but in practice it has no lift because there isn't the administrative infrastructure. All the other supporting parts don't exist.
What we need to look at in Canada is the role of Treasury Board. It's the role of access and privacy coordinators and making sure they're appropriately trained, that they're sufficiently senior in an organization, and that they can provide timely advice to lawmakers and government officials. It's about the role, of course, of the Privacy Commissioner.
I come back to talking about flexibility. One of the things that attracts the CBA to the enhanced ombudsman model is that we think it provides a measure of the flexibility we need to meet the evolving world of new and different challenges to privacy.