Evidence of meeting #25 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was statute.
A recording is available from Parliament.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Thank you very much to both of you for coming here. It's been quite interesting.
I'm going to ask a similar question in two different forms.
Mr. Geist, I've read some of your writings. You talk about a policy called “opt-in consent”, which I found very intriguing.
You brought up the Ministry of Health, so I want to give a bit of background. As pharmacists, one thing we've found is that whenever any patient wanted to sign up for the government drug plan, they first of all had to opt in to give consent and also to provide specific information. To verify their income, they had to give specific consent so the health ministry could talk to CRA to make sure the income was verified, in order for the ministry to determine and discern what deductible group they were going to be in.
Here's my question for you. When we talk about government agencies and government departments, sometimes they may have to talk to people but opt-in consent is not given. You've said that you feel that should be the default approach. How do we strike that balance to make sure the government is still effective and still running efficiently? Could you maybe highlight how we can strike that balance?
Canada Research Chair in Internet and E-commerce Law and Professor of Law, University of Ottawa, As an Individual
I'd start by noting that some of my writings around opt-in consent have tended to focus on the private sector side, where we have legislation in PIPEDA that opens the door to both an opt-out and an opt-in system. It seems to me that the opt-in standard is a more effective one from a privacy perspective, and I think leaves individuals with much better knowledge about what they're actually agreeing to and how their information is going to be used.
As Mr. Fraser pointed out off the top, the consent model doesn't map as nicely on the public sector side because there's lots of information that government is going to collect with or without our consent. In a sense, our consent doesn't really matter. There is certain data that you have to have.
Your particular example is a good one though because it takes us into the realm not of collection but rather of use, and raises the prospect of asking if we could establish, or if we should establish systems that more effectively give people some amount of control over their information, not necessarily at the collection level—although even there we could think about what we could do—but more at the use level and at that sharing level.
Are there certain things that we don't need consent for because there is no reason to think about consent? Where we are looking more into opting into certain kinds of programs and it is necessary to have that information to do it, then you can make the argument that, perhaps it's more appropriate to say, if you don't want to avail yourself of that service or that opportunity, that's your choice. But the only way that you can is if you provide the necessary consent.
Partner, McInnes Cooper, As an Individual
I'm in agreement with Professor Geist on that. There are opportunities, particularly if somebody is enrolling in a program, that they don't have to, where it is in fact much more of a voluntary relationship. Mostly your relationship with the government is involuntary, but when it's voluntary, we need to be absolutely clear and transparent. I think we should make efforts to avoid surprises.
Privacy is one of those weird things that really goes to the core of people's emotional well-being. They want the autonomy. They want control of their information. If you tell them that as part of enrolling in this program, there is going to be income verification and it's going to take place a certain way, and the person signs up, they're not going to be surprised and they're not gong to be upset by that. Or they can question whether it's really necessary, and in that way, they get to participate as a much more informed citizen.
Liberal
Raj Saini Liberal Kitchener Centre, ON
The second question I have is particularly to you, Mr. Fraser, because you've also written about the fact that the physical location of data is not that important anymore. In your previous brief you highlighted two cases, one on Microsoft and one on eBay.
Based on that, sometimes, as you know, there is going to be data sharing between governments. When we receive data—let's say we have asked for taxes for someone who is living in a different country—we take that data and we have it reposed in CRA, but that data could possibly be shared with other government agencies and departments without that person knowing.
We still have a regime here that's still foundationally sound. It can be improved. I can agree with that. In other countries, that may not be the case. Information could be shared without the person knowing, and their privacy regime may not be as robust as ours. How do we reconcile that?
Partner, McInnes Cooper, As an Individual
I think that one of the themes of my writing and thinking on this topic is that the location of the data is one factor, but it's not the overwhelming sine qua non of what the issue is. There are other factors that go into it. The Treasury Board policy related to this topic is in fact a really good and really rational approach to it, which is, if any government department is going to make any decision about the location of data in connection with outsourcing, or anything else like that, location is going to be a factor, but there are other things as well. Who is going to be the service provider? Who are they beholden to? What national ties do they have?
We're starting to see a more nuanced evolution of this as a question, which is in contrast to the situation in Nova Scotia and British Columbia where they have a statute that says thou shalt not allow the personal information outside of the country. You can still hire an American service provider to manage it for you on your own territory, and they—at least according to the U.S. Department of Justice—are as subject to the Patriot Act when they stand in Canada as they are in the United States. Just saying it needs to be here doesn't alleviate all those concerns. We need a nuanced risk analysis understanding.
There's been mention a number of times of privacy impact assessments. I think those are a really great tool that give you the opportunity to look at whatever is going on from a number of different perspectives, a number of different privacy risks, to force you to think about how to mitigate this and if the risk is acceptable depending on the sensitivity of the information, and then to have those reviewed by the commissioner and have those made public so there's transparency into these sorts of decision-making functions.
Liberal
The Vice-Chair Liberal Joël Lightbound
Thank you very much.
We're out of time, Mr. Saini, but we'll have plenty of time at the end.
Mr. Jeneroux.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Thank you.
You both touched on privacy impact assessments. I would like to get more details on why you think it's necessary that they're enshrined, specifically, into the act, as opposed not to.
Canada Research Chair in Internet and E-commerce Law and Professor of Law, University of Ottawa, As an Individual
Unless you establish clear signalling and a prioritization within the act, you end up with what we have had for the last period of time, which is that privacy too often becomes an afterthought on legislation that has a significant privacy impact.
On the legislative side, baking privacy into the process is important, not so much privacy by design, so to speak, as it's sometimes referred to, but rather ensuring that there's a recognition that considering the privacy implications of legislation is essentially part of the legislative-making process.
Further, and this was touched on in David's comments a moment ago, where you're confronted with some of the really challenging issues that the last question raised around location, around transfer to what we might see as low protection jurisdictions, whether for sharing purposes or other transfer purposes, one of the ways to at least begin to think about whether or not this is something we ought to be doing or whether or not there ought be some limitations established is to conduct privacy impact assessments.
The move to enshrine that legislatively has a signalling effect, and it also may have a real world effect in ensuring those kinds of things happen.
Partner, McInnes Cooper, As an Individual
I would echo that.
If Parliament puts that in the Privacy Act, it says that this is, in fact, an absolute priority. If it's left in a Treasury Board policy somewhere, it's at the whim of the government and it could be reversed. If you do not do a privacy impact assessment, and you're legally required to under under the act, you've broken the law, which is more than slightly different from just avoiding a policy, skipping a policy, or a procedural step.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Mr. Chair, and thank you to the witnesses. This is a very interesting discussion.
I want to begin with a blog that you wrote, Mr. Fraser. You said, “You’d better forget the right to be forgotten in Canada”.
I thought that was really interesting. I can give you an example. When I was with the Saint John Sea Dogs, a hockey team, we had an issue with a teddy bear toss. To make a long story short, the teddy bears, potentially, were infested with bedbugs. We had to cancel the teddy bear toss, but for years and years, if you Googled “Wayne Long”, the first thing that came up was bedbugs. Whether I wanted that or not, I couldn't get rid of it.
You're of the view that:
...the right to be forgotten cannot be shoehorned into existing privacy law because search engines do not come within the scope of PIPEDA and the activity of indexing newsworthy content online is subject to the journalism exception in PIPEDA. Furthermore, any attempt to compel a search engine to not include particular results—particularly pointing to lawful content—would fall afoul of the freedom of expression right under the Canadian Charter of Rights and Freedoms.
Can you elaborate on that, give me more? Maybe Mr. Geist, you can comment as well.
Partner, McInnes Cooper, As an Individual
It's a very complicated issue. I'm not unsympathetic to people like yourself. I've represented and advised clients. A significant part of my practice is cyber-bullying, helping individuals who've had issues.
You are not alone. I've certainly had people across the table from me crying because their dating lives and other parts of their lives have been impacted by what shows up in search engines.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
It's a good thing we won the Memorial Cup and I'm in politics, because now that's bumped way down low.
Partner, McInnes Cooper, As an Individual
Excellent. That's a practical strategy for dealing with that issue.
The issue is how to fix that in a legal sort of way, consistent with our Charter of Rights and Freedoms that has section 2(b), and our privacy law that has a journalism exception. We don't think the same way as in Europe where, in fact, privacy takes precedence over freedom of expression. In Canada, you usually have a balance when it comes to charter rights. You have a charter right to freedom of expression. You don't have a charter right to privacy, other than unreasonable search and seizure.
It's a complicated argument, but I don't think that one can find a way in PIPEDA to make that work in the way that people who talk about the right to be forgotten talk about it. In a practical sort of way, most of those search results would be newspapers that were reporting on it.
Partner, McInnes Cooper, As an Individual
You would not be able, in Canada, to get a court order requiring a newspaper to unpublish something that was true. Our body of case law related to freedom of expression, defamation, and other things like that support that entirely. If you can't tell the newspaper not to publish it, not to make it available anymore, should you be able to tell an uninterested third-party search engine to not tell people that it exists?
Liberal
Partner, McInnes Cooper, As an Individual
I'm not sure I have a solution. I have the advantage of getting to stand on the sidelines and point out problems. To the extent that I can contribute to solutions, I'm happy to. The problem is always going to be a threshold one, and I think the problem needs to be addressed by the people who are publishing it, rather than intermediaries who are pointing out that it exists. The analogue is, you wouldn't hold a librarian liable for telling you that down in the basement in the dusty stacks is a newspaper from 20 years ago that has this article. You need to be consistent. It's not the technology that necessitates making the rules. Technology might make new problems surface, but our democratic framework that includes freedom of expression needs to be superimposed over all those decisions.
I think this Parliament did a fantastic thing with Bill C-13. The first part of it related to the non-consensual distribution of intimate images. I've seen first-hand the huge amount of harm that sort of activity causes my clients. I think that is a very helpful addition, and that can be put in the continuum of the right to be forgotten. The Ontario courts have made it possible, just under the common law, for an individual to get a remedy in damages for that horribly harmful behaviour, and that can lead to an injunction to get it taken down.
One can easily say at the extreme end of the continuum that, when you're dealing with horrible revenge porn, whatever you want to call it, it's absolutely deplorable. There's no doubt that laws can work on that, but things like those teddy bears having bedbugs are part of living in a modern world.
Canada Research Chair in Internet and E-commerce Law and Professor of Law, University of Ottawa, As an Individual
I have a couple of comments. First, I'm not particularly supportive of the right to be forgotten. I have seen it come up in a context. Actually, I sit on the board of CanLII, the Canadian Legal Information Institute, which makes Canada's laws and decisions available online. Those have been available online for a long time. We don't index through Google, although we've had a number of instances where people have captured many of those decisions. They've been made available through Google, and people have found out that a decision from many years earlier is in fact available online.
I must admit I've never been particular sympathetic about the need to remove that information. The need is to address it up front, let's say in the court context, by redacting, say, sensitive family information from court decisions. Once it's published, open-court principles apply. I think the same is largely true in this context.
The one place that I would differ slightly from what David was talking about is over the issue of jurisdiction over search engines, whether we could compel them to do something. In fact that exact issue—not in the exact same context—is before the Supreme Court of Canada in a decision that will be heard in early December, Equustek v. Google, in which the B.C. courts have ordered Google to remove from their search results certain content that a B.C. party alleges violates their intellectual property rights. The B.C. courts have ordered Google to do so, not just for the search results that are made available to Canadians through Google.ca, but rather for the entire world.
Canada Research Chair in Internet and E-commerce Law and Professor of Law, University of Ottawa, As an Individual
So we have Canadian courts saying they can do it. Our Supreme Court of Canada will presumably render its view as to whether or not Canadian courts get to decide for the rest of the world by asserting jurisdiction in that fashion.
