Information & Ethics Committee on Oct. 4th, 2016

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair.

I am going to come back to the aspect that was just raised by Mr. Bratina, that is the commissioner's recommendation that the scope of the act be expanded so that it can be applied to ministers' offices and to that of the prime minister.

In Canada, it used to be enough to access the prime minister's website for our email addresses and certain other information to be requested from us. The Government of Canada gathers information. In fact, not only the government but, in some instances, ministers offices and the office of the prime minister do it as well.

Is the premier's office subject to the Privacy Act in your provinces?

My question is first for the representative from Newfoundland and Labrador.

[Donovan Molloy]

In Newfoundland and Labrador, the premier and all the ministers are subject to the privacy legislation.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

What is the situation in Nova Scotia in this regard?

[Catherine Tully]

The same thing is true in Nova Scotia.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

What about British Columbia?

[Drew McArthur]

Yes.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

All right.

I have another question on the possibility of expanding the scope of the act.

Are political parties covered by the act? At the federal level, more particularly, we know that political parties often find themselves in a kind of limbo where they are not considered public entities or, more obviously, private businesses.

What is your experience in this area in your respective provinces regarding the situation of political parties, more specifically under your privacy acts?

I will begin with the representative from Newfoundland and Labrador.

[Donovan Molloy]

Political parties are not public bodies. They're not subject to the act.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Are they subject to provisions respecting private businesses?

[Donovan Molloy]

I hadn't really....

[Sean Murray]

Not to my knowledge.

[Donovan Molloy]

Not to our knowledge, no.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Is the situation the same in Nova Scotia?

[Catherine Tully]

It is the same.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

What is the situation in British Columbia in this regard?

[Drew McArthur]

In British Columbia, all political parties—federal, provincial, and municipal—are covered under B.C.'s private sector privacy legislation, PIPA.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you.

It is interesting to note that there may be a difference among the provinces on this point.

As my time is nearly up, I would like to go back to the role you play within the departments and public organizations to verify the level of protection that exists for personal information.

Are you directly involved in risk assessment? We know that risks are increasing these days, in this technological era. Are you involved yourselves, as commissioners, in assessing the risks of data theft or citizen privacy breaches?

How does that work in British Columbia?

[Drew McArthur]

In British Columbia, there are several ways in which we consult with government.

First, we are actually consulted when draft legislation is being considered to ensure privacy protections are included. Second, when governments are implementing new programs, we are also consulted. In some cases, privacy impact assessments are required, and we work with the government in understanding and mitigating the risks associated with that. Finally, in our legislation, we have the ability to audit. We have used that ability to go in and examine an operation to determine if the protections in place and the processes are considered best practice.

[The Chair, Conservative, Blaine Calkins]

That takes us to our free time, colleagues. We don't have anything else on the agenda, but I know that Mr. Lightbound would like to ask a few questions. If any of you have any other supplementary questions you would like to ask....

I then want a few minutes at the end, if you don't mind, to talk about the witness lists that are coming up for the remainder of the study.

Mr. Lightbound.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Thank you, Mr. Chair.

First of all, I want to thank the witnesses for their contribution to this discussion.

My first question concerns one of the recommendations that Commissioner Therrien made, that he would like the information-sharing among government institutions and agencies to be governed by information-sharing agreements and accords that are detailed and public. I would like to know whether you have those kinds of agreements in your respective provinces on information-sharing among government institutions and whether they are public.

[Drew McArthur]

We do have in our legislation the requirement to create and implement “information sharing agreements” in accordance with the directions of the minister responsible for our act. These directions actually have yet to be issued, but so far the government is [Technical difficulty—Editor] guidelines on what information should be in an information sharing agreement and when an information sharing agreement should be completed.

We believe they're a useful tool to ensure compliance with privacy legislation. They document responsibilities for each of the parties to the agreement and the conditions around the collection and disclosure of personal information. We see them as a good measure for accountability when increasing amounts of information are being shared.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Thank you.

Would the Information and Privacy Commissioner of Nova Scotia like to add something on the subject?

[Catherine Tully]

I was used to the regime that Drew has just described in British Columbia. Then I came to Nova Scotia where there's no mandatory requirement for information sharing agreements. There's no direction specific from government that's regularly followed, as far as I know, because there's no mandatory consultation with my office so I don't see them. I'm a big fan of information sharing agreements. It forces organizations and government departments to think about what they're going to share, why they're going to share it, what their authority is, and what security they're going to build around it. It's a very good tool. It tends to make them reduce what they're doing, be clear why they're doing it, and monitor how it's happening.

[Sean Murray]

If I can speak from our perspective, we are in a similar situation to Commissioner Tully. We don't have a requirement under our legislation for information sharing agreements. I couldn't tell you the extent to which they're being employed. I believe that on an ad hoc basis they are being used from time to time, but we wouldn't have the opportunity to review them because it's not mandatory under our legislation.

We have, on occasion, recommended an information sharing agreement when we have had an opportunity to be involved. For example, we would recommend that type of thing when we're involved with conducting an audit or an investigation or if a public body comes to us seeking consultation voluntarily.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

If I may, I have just one last question for Madam Tully. I think it was in your opening statement that you mentioned something about the detailed purpose clause that you have in Nova Scotia. I was wondering if you could elaborate on what it entails.