Evidence of meeting #26 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was breaches.
A recording is available from Parliament.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Do you think it would be ideal, then, to have both offices in one?
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
From our perspective, we've never experienced having the two separate. Just from the work we do, there are often cases where there are access to information and privacy issues involved in the same investigation. Our people have expertise on both sides.
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
I agree with Drew.
At the provincial level, it works really well, because this is the system we're used to. At the federal level, though, these are two huge issues and they take a lot of attention. It seems to have worked well having them separate. Those are my thoughts.
Conservative
The Chair Conservative Blaine Calkins
I think our friends from Newfoundland and Labrador are trying to communicate with us, but they're muted.
October 4th, 2016 / 11:55 a.m.
Executive Director, House of Assembly, Office of the Information and Privacy Commissioner of Newfoundland and Labrador
We are not muted here.
At the national level, especially, I think it's important to have a champion for access to information and a champion for privacy, who can be recognized and speak to those issues separately, be leaders across the country, and represent those issues internationally as well. I think it has worked very well from that perspective to have them as separate offices. At the provincial level, functionally, I don't think there would be any need to have that separation.
Liberal
Raj Saini Liberal Kitchener Centre, ON
The second question I have is about the potential pitfalls of the over-sharing of data. We've heard some concerns from other witnesses that, with data now moving from paper-based to digital-based, sometimes there can be an over-collection of data but also an over-sharing of data, not only within government but with other jurisdictions. One of the ways this has been solved in the private sector is by an opt-in, opt-out model.
Can you highlight how we can balance the government's requirement or need to operate effectively with making sure there is no over-sharing of data?
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
My initial response to that question is that there is a threshold in our provincial legislation that the data must be necessary for the operation of a program.
The inclusion of the word “necessary” in our legislation [Technical difficulty—Editor] the amount of over-collection and therefore protects from over-sharing in the after sense. The inclusion of “necessary” covers off the concern about whether information may be over-shared in one sense. In the other sense, in our case, we do have in our legislation the requirement for information sharing agreements, which would typically make the process transparent or—in the case of information that is sensitive for national security—at least ensure that the appropriate protective measures are being implemented when information sharing agreements are put in place.
Conservative
The Chair Conservative Blaine Calkins
That takes us to the end of the seven-minute round.
Thank you very much, Mr. Saini.
We now move to the five-minute round, and we'll begin with Mr. Jeneroux.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Thank you very much.
Thank you to all three of the groups for being here with us today on video conference. I appreciate your taking the time out of your day.
Before I move on to my questions, I think Mr. Saini let you off the hook a little too easy there, with some of those answers in terms of combining the offices. If I remember, Ms. Tully, you said the issues are important at the federal level. Are they not as important at the provincial level?
You folks in Newfoundland mentioned champions. Is that not championing at the provincial level as well?
Mr. McArthur, I think you said you don't know any other way, so it works.
Maybe you could elaborate on your positions just slightly. The other argument to that is cost-savings, if you combine the two, and that didn't come up in any of the answers. If you guys don't mind elaborating, before I get to my question, that would be great.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I think the only thing that comes to mind is that the size of our operation in British Columbia is approximately 40 people. That is not a large operation when considered against the size of the federal Privacy Commissioner's office or the Information Commissioner's office. There may be opportunities of scale, but in our case, because of our size and our jurisdiction, it remains effective for us having both access to information and privacy in one piece of legislation.
In some cases in the international context, the two are separated. It may make a difference when you're dealing with issues internationally.
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
I think the only other thing I would add is that the issues on the privacy side are complicated. The technology issues associated with it, the fact that data is moving around the world, these are all managed by these data protection offices that our Privacy Commissioner is an equivalent to. Having a leader in Canada on that issue I think is very important for our government and for the provinces as well. That stands out when you have an identifiable privacy commissioner and it's consistent with the approaches taken in other jurisdictions. I would say that it's likewise on the information side, having a leader in that way.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
So you don't think having the minister of justice, which the Privacy Act falls under, would be enough of a voice internationally to do that.
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
I think those are very important voices, for sure, but there's a whole layer of these oversight agencies contributing significantly to the conversation around what our privacy standards are. Not only that, but they have these enforcement authorities, these fining authorities, that are making sure that these rules are followed. They're an important part. Both things have to exist, for sure.
Conservative
Privacy Commissioner, House of Assembly, Office of the Information and Privacy Commissioner of Newfoundland and Labrador
I don't think we're saying that they can't be done together and should never be done together. It's just that in certain circumstances it would seem better to have them apart. If you're talking economies of scale, when you go to, for example, order-making powers, then you're talking about expanding two offices.
It depends on where your values lie and to the extent that you have, in any given situation, a Cadillac or a Civic, I suppose.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Thank you. That's a great transition to my next question.
In terms of the order-making model, we've heard recently that a hybrid model is perhaps an option to move forward.
If we go around the group, we'll probably run out of time, but we can come back to it in my next line of questioning. What do you see works best, and what you would recommend as part of the Privacy Commissioner's recommendations?
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
In terms of an order-making power, as noted, we have that ability in our sector legislation. We have taken the opportunity to use that from time to time, and find it effective. It also, as we've indicated, turns the parties' minds, through the mediation process, to be much more in tune with the sensitivities of each party. It assists us in getting to the resolution of complaints at the mediation phase rather than having to proceed through, but it provides us with the ability for order-making powers should we have to go beyond the mediation phase or if mediation hasn't been accepted.
Conservative
The Chair Conservative Blaine Calkins
That takes us to Mr. Long.
You have up to five minutes, please.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Mr. Chair.
Thank you to all our presenters this morning. I think this is very informative.
Mr. McArthur, I'm sorry we can't see you, but I've read a lot of your articles and I've read about you with great interest. You have a very interesting background. You were a founding member, I believe, of the Canadian Council of Chief Privacy Officers. You were chief compliance officer with Telus, and I believe the Telus privacy policy was actually a gold standard for policies like that.
Obviously you've worked in both the public sector and the private sector. I'm wondering if you could give us a comment on how working in especially the private sector maybe gives you a different perspective on things now that you're in the public sector.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
In a recent presentation I made I highlighted some of the shifts in moving from being regulated to being a regulator. It's been an interesting learning curve for me and I've become more sensitive to some of the issues.
Specifically I'll talk about mandatory breach notification. When I was in the private sector, we worked very hard to come up with voluntary breach notification guidelines, and we worked with the privacy commissioners across the country to implement those as guidelines for organizations. I now see those embodied in the federal privacy legislation, Bill S-4. When the regulations are implemented, we will see that for federal private sector organizations. We see it in Alberta, and we've recommended it in B.C., and the B.C. government has accepted that.
What was once voluntary in the private sector is now becoming de facto standard of being mandatory. We also note that in Europe the general data protection authority has come out to indicate that mandatory breach notification is required. I'll also note that they've taken a few steps further than that, and it's going to be significant for Canada to continue to be substantially similar with the requirements of GDPR for the free flow of information as it relates in the private sector for organizations that operate multinationally.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you for that.
Mr. McArthur, I'm just going to stick with you briefly, then we'll go to our other presenters. I just want to get your perspective on the triple-delete scandal that happened in B.C., and the other one I read about was that there was a breach with Island Health. There was a chief of staff of the government who was basically charged. Correct me if I'm wrong, but he was really charged with lying to cover it up, not actually the delete, delete, delete. For those who aren't aware, they deleted them out of their inbox, then deleted them out of the trash file, and then deleted them off the server. I know you were quoted, saying, “There should be penalties and fines”. You feel they should be reprimanded more strongly. I just want to get your perspective on the triple delete, and then get our other panellists' perspective on the harshness of fines.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I will say the triple-delete investigation—we call it a scandal here in B.C.—resulted in a significant number of recommendations for government and a catalyst for change, so there has been some good coming out of that investigation. On the specific circumstances around the individual, you are correct in that he perjured himself in his testimony given to my former colleague Elizabeth Denham, the then privacy commissioner, and he was charged under the act. That was the first circumstance where that had occurred.
We have recommended that the fines to individuals be increased to a substantial level, and the reason for that recommendation is evident in some of the more recent, as the media calls them, snooping incidents into personal health records of individuals, where employees of health authorities who have access to patient information, but no need or business need to access specific patient files, go in and snoop. We believe there are significant deterrents required in order to prevent the amount of snooping that we see going on, not only in B.C. but across the country.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Quickly, I know you said fines should be increased to a significant level. Correct me if I'm wrong, are they currently $5,000 for a breach?
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
Correct. We recommended to our committee that they be increased to $50,000, and the committee recommended to the legislature that they be increased to $25,000.