Evidence of meeting #26 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was breaches.
A recording is available from Parliament.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
That's correct.
Conservative
The Chair Conservative Blaine Calkins
Mr. Long, I know you wanted to hear from others, but we are well past the five-minute mark so we're going to go back to Mr. Jeneroux. Keep in mind, colleagues, that we will have a bit of time at the end of the meeting. If you have some unfinished business or unanswered questions that you'd like to get on the record, we can certainly get to that.
Mr. Jeneroux, we're back to you for five minutes.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Wonderful. Thank you, guys. If we could follow-up with Ms. Tully, Mr. Molloy, and Mr. Murray on which model you would prefer, that would be great.
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
Is that a question going back to the order-making versus hybrid?
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Yes. I'm sorry. To clarify, we have a number of models before us, one that the Privacy Commissioner prefers. What are your comments on what you feel is the best model that we should implement at the federal level?
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
From having experience with both order-making and recommendation-making, I can say without hesitation that plain recommendation-making is not a good model. I would say one of the other two is definitely what I would strongly recommend. As I have mentioned, I think consistency across those two offices is very important.
Order-making worked really well in B.C., I thought, for a lot of the reasons Drew has mentioned. When there's order-making, the informal resolutions go faster, the public body is taken more seriously, there's less foot-dragging, they're more willing to engage and engage quickly, and they have better submissions.
When you only get to recommend at the end, there's a degree of inconsistency in terms of who's accepting and who's not, so it's hard to set a good standard across all public bodies, because some are willing to follow the recommendations and some aren't. It definitely needs more.
I like the hybrid model for a small jurisdiction. I think that would really work. My office is very small. There are only seven of us. There's no way we're going to have resources to be able to have a separate adjudication unit, whereas the federal offices are large and probably much more capable of absorbing that responsibility.
Privacy Commissioner, House of Assembly, Office of the Information and Privacy Commissioner of Newfoundland and Labrador
A pure recommendation model is completely ineffectual. From our point of view, the fact that a recommendation can become an order in 10 days motivates the public bodies and other authorities to co-operate and to get these things concluded, because if it goes to a formal report and they're not prepared to follow the recommendation, they have to go to court and they have to justify why they didn't. I think the hybrid model is fairly powerful as well.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Mr. Chair, if I may, I'm going to finish Mr. Jeneroux's time, if that's all right.
I'm going to pick up on something that Mr. Molloy mentioned. I think it was in response to Mr. Erskine-Smith's question or maybe it was in your opening remarks. You mentioned situations where reporting may compound harm done in a privacy breach, if I understood correctly.
Could you maybe elaborate on some of the perils of reporting where, yes, somebody's privacy may have been breached? Perhaps they had not come to harm as a result, and yet the reporting process may create harm.
Privacy Commissioner, House of Assembly, Office of the Information and Privacy Commissioner of Newfoundland and Labrador
There's a tendency to err on the side of caution with respect to the notification of individuals. We certainly don't want to discourage notification, but the issue becomes the appropriate interpretation of what is a material breach, and secondarily, whether it is something that has the potential to harm someone.
If you have a breach, and you decide you're going to notify people that there has been a breach and they're at risk of harm, if they were never really at risk of harm, the individual notifications shouldn't have gone out. Then they come to our office, and we try and tell them that, no, this was a circumstance where we concluded that there was no risk of harm to you. Once you've been told that you've been put at risk by a breach of your privacy, it's very hard to convince anybody that they aren't at risk and that the notification was unnecessary.
People get stressed and they start worrying about identity theft, embarrassment in their community, and all kinds of things that they were never put at risk of having happen to them.
October 4th, 2016 / 12:15 p.m.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much, Mr. Kelly.
We'll now move to our last five-minute questioner.
Mr. Bratina.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Thank you.
I believe I heard that both the Newfoundland and Nova Scotia witnesses generally agreed with the recommendations that were put forward.
I'm wondering, Mr. McArthur, if you've had an opportunity to review the recommendations and whether you have a general opinion.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I have had an opportunity to review. In the areas that affect British Columbia, in the areas that I spoke about—those being mandatory breach reporting, order-making powers, and the requirement for safeguarding personal information—those were the general areas where we saw we could provide some insight as it relates to the operations here in British Columbia.
On a broader note, I really would only comment that it's been a significant number of years since the Privacy Act was amended. It probably is very timely and opportune that at this point in time you take the opportunity to bring it into alignment with the other activities that are going on around the country and internationally. There's been significant progress. I mentioned the general data protection regulations in Europe.
I'd like to give Bradley a moment to make a comment, as well.
Bradley Weldon Senior Policy Analyst, Office of the Information and Privacy Commissioner of British Columbia
This is Brad Weldon.
My observation here would simply be that our act is reviewed every six years, and every six years we have significant revisions recommended. I think it makes a lot more sense that our act provide for that sort of a review. It is, I think, remarkable that it's been this long since significant changes have been made to the Privacy Act.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Let me go on.
The Privacy Commissioner has recommended to “Grant the Privacy Commissioner discretion to publicly report on government privacy issues when in the public interest”. I'm curious about that, because the Privacy Commissioner does have the power to issue special reports. These are typically annual reports to Parliament.
Perhaps I'll direct this first to Newfoundland and Labrador, but with the awareness that the Privacy Commissioner can make comments throughout the year at his discretion, I wonder whether there would be pressure on him, almost every day or week, to come up with media responses to any number of issues. Do you see any danger in that?
Privacy Commissioner, House of Assembly, Office of the Information and Privacy Commissioner of Newfoundland and Labrador
Personally, no. The opportunity to make comments generally and educate the public is encompassed within our mandate for advocacy and public education. There are things.... For example, last week was Right to Know Week. I made some public comments about open government, open contracting. We're trying to educate people on how the system could work better.
There is really no need to go looking for an opportunity to do an individual report, unless something specifically of consequence has happened. We'd be very reluctant to start making it a weekly bulletin with “here's the latest”. I think it would genuinely have to have merit, it would be significantly evaluated, and the public interest would actually have to require it as opposed to, maybe, favour it.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Ms. Tully, the recommendations include extending “coverage to all government institutions, including Ministers’ Offices and the Prime Minister’s Office, and extend rights of access to foreign nationals”. On this recommendation, is your premier covered under this in the manner that the Prime Minister would be?
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
Yes. The offices of ministers are covered as the head of the public body.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Does that function well, in your view, in your experience?
Information and Privacy Commissioner for Nova Scotia, Office of the Information and Privacy Commissioner of Nova Scotia
There are some challenges with that, for sure, but I think it's a very important part of access law.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
In B.C., the legislation does cover government and ministers' offices. There is an exception for cabinet confidences and a number of other exceptions. The threshold is pretty high over when government can withhold information, but it does apply to all the operations of government.
Conservative
The Chair Conservative Blaine Calkins
Our last question is for Mr. Dusseault, for up to three minutes, please.
Does anybody else want to get their name on the list? Okay, I have Mr. Lightbound.
Monsieur Dusseault, please.
