Information & Ethics Committee on Oct. 4th, 2016

[The Chair, Conservative, Blaine Calkins]

Mr. McArthur and Mr. Weldon, for the benefit of our recording process here in Ottawa, please identify yourself at the start of any comments either of you make, so we can make sure that we attribute the comments to the appropriate person. We can't see who's talking, so that would be helpful to us.

Colleagues, I will ask you to be specific if you're asking a question of a witness to make sure they are clearly identified. If you're asking it of all witnesses, then I'll make sure that we get that through.

We're going to resume with our seven-minute round, and we'll go to Mr. Kelly for up to seven minutes, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you, Chair.

I'd like each witness to give a brief statement—and we had a bit of that from B.C.—and describe a little about the nature of the types of privacy breaches you receive. We're talking about mandatory reporting, and the number of breaches could be quite high, at least based on the B.C. experience of an estimate of around 1% of the current breaches being reported. If all breaches are to be reported, a privacy breach can be any of a number of things, from the careless leaving behind of a piece of paper to a sophisticated cyber-attack, or a lost laptop containing thousands or maybe even millions of different records.

More specifically in the way that specific lives might be affected by such breaches, could each of you give a quick, even anecdotal, discussion of the kinds of things we're dealing with? I'll start with our Newfoundland and Labrador witnesses, Mr. Molloy and Mr. Murray.

[Donovan Molloy]

For the most part, the majority of the breaches reported to us—and we have mandatory reporting of all breaches under ATIPPA—are incidental, accidental, careless, and generally things that don't involve an intent to abuse, share, or disclose somebody's personal information.

We do have a number of instances where people have deliberately accessed other people's personal information and that has been shared or disclosed. The impact on the people who are affected by it is profound. Once you've been deprived of your sense of privacy and your dignity, depending on the nature of the information, it makes it difficult to move forward in your relationship with a particular public body or a government in general.

Conversely, we would note that we've experienced situations where the unnecessary notification of individuals that their privacy has been breached can cause a lot of damage, as well. Once you've been notified it's hard to put the genie back in the bottle. People have a hard job being convinced that the breach didn't have any impact on them.

[Catherine Tully]

In Nova Scotia, we do not have mandatory breach notification for significant breaches. Instead, what we see are the minor breaches I mentioned. I think we received reports of in the neighbourhood of 900 minor breaches of personal health information last year. About a third of those are missent faxes or the high-tech version of that, which is selecting the wrong provider code in a database so that health information goes to the wrong provider. It's these types of breaches that tend not to cause significant harm. Occasionally, we hear about more significant breaches. These are the snooping in databases. In small communities, that's quite significant both in terms of finding locations for individuals or finding medical information, including mental health information, which is quite embarrassing.

[Drew McArthur]

I mentioned briefly the kinds of breaches that we've seen in government. I'd like to highlight a couple that resulted in investigations. One was with the University of Victoria and involved an unencrypted hard drive containing employee personal information. The other was with our Ministry of Education and also involved an unencrypted hard drive. Although it was lost, it contained student data for over 300,000 students in B.C. These are serious circumstances where people may need to take action.

I'd like to add a further note on the need for thresholds in reporting. We have identified that the threshold in the public sector is when a breach could be reasonably expected to cause harm to an individual or if it involves a large number of individuals. We've set that for the notification of the commissioner, and when notifying individuals, we've recommended that the threshold be when it's expected to cause significant harm to the individual. Again, significant harm is contextual. We don't have experience with it yet. We've set the two thresholds to be slightly different in that a lower threshold for reporting to the commissioner would allow us to work with public bodies to make sure they have programs in place to prevent disclosure of this information to the unauthorized access user. It would also ensure that individuals are informed without unreasonable delay so that they may protect themselves.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

What additional infrastructure would need to be in place to adopt mandatory reporting?

I understand that in Newfoundland and Labrador there is already mandatory reporting. Given the limited amount of reporting currently going on where reporting is not mandatory, what additional infrastructure would the federal government likely need to have in place, also noting that federal institutions are, in many cases, quite different from provincial institutions? Provincial institutions tend to be more service-oriented, where there are agencies with which people have a mandatory relationship like the CRA or the Canada Border Services Agency.

I'll let maybe each of you have just a quick moment to comment on what changes will need to happen within federal institutions to accommodate mandatory reporting.

[The Chair, Conservative, Blaine Calkins]

We're already past seven minutes, but if somebody has a quick comment on this, we'll get to it.

Mr. McArthur?

[Drew McArthur]

In terms of infrastructure from a technical perspective, nothing is required. It's merely a process to receive the complaints. I would note that in B.C., even though it is not mandatory, we already do receive, track, and investigate, if required, voluntary reports. We have the administrative processes established already. I also know that the federal privacy office has the process in place for receiving reports because I made those, unfortunately, from time to time when I was in the private sector.

[The Chair, Conservative, Blaine Calkins]

We're going to have to move on now. We're approaching eight minutes.

Mr. Dusseault, you have up to seven minutes, please.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, Mr. Chair.

My first question concerns an aspect that was mentioned by our friends from Newfoundland and Labrador concerning the mandatory regime that exists in that province. The provincial government is required to report to the commissioner when there has been a breach of privacy.

If you discover that that requirement has not been met and that the department has not reported the breach, does that result in consequences? Is the matter followed up? What happens when there has been a breach of privacy that was not reported to you?

[Sean Murray]

I don't think we've had the circumstance where there's been a breach that turned out to be something notable that wasn't reported to our office. You're correct that there are no penalties built into the act in cases where a public body fails to report a breach to our office. I guess that might be worth considering. We've had this for about a year and a half now, our new law, and we have noted that some public bodies seem to be reporting more breaches than others. It's something that we have inquired about, and I would suspect it's something we will probably follow up on in due course, but at this point I can't conclude that any public body has been purposely not reporting breaches to us. I guess that's something we'll have to look into.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you.

I would like to go back to the witness from British Columbia regarding the requirement to inform citizens when their privacy has been breached. I would like to go back to what you also mentioned, that is to say the reputational harms, financial harms and even those concerning people's identities.

In British Columbia, is there a way for citizens to sue the government, for damages or even remedial measures? The Canadian commissioner is proposing remedial measures, including damages, for privacy breaches. Is it possible for a citizen in British Columbia to take legal action to obtain compensation?

[Drew McArthur]

At this point in time we're still awaiting the legislation to determine how it will actually be implemented. However, what we can do is order a public body to take the appropriate steps to mitigate the harm. In some cases that mitigation may involve credit monitoring or other steps depending on the circumstances.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Thank you, that is very interesting. It is nevertheless a measure the government can take in the circumstances.

Now I will speak to the commissioner from Nova Scotia, and this could be of interest to the other provinces.

I wonder whether an effort is being made to educate not only the population in this regard—which is very laudable—but especially government employees. The latter must know their obligations under the Privacy Act. They must be informed about what they do every day and what might have an impact on the privacy of the citizens of their province or Canada. Are security measures being put in place, for example, to inform employees about whether spam is being circulated? Are there any measures to inform government employees that they should not open certain emails and in order to prevent citizen privacy breaches?

[Catherine Tully]

As the information and privacy commissioner I do have an education mandate, but the government itself also has a central group who manages access in privacy, and they provide privacy training within the government departments proper. Most of the training that I do is for the smaller public bodies, the municipalities and the agency boards and commissions, because they have no other source of training. I have a bunch of tools available, including security standards and recommendations for steps to be taken. I have tools on how to manage a privacy breach. We offer privacy breach training to any public body, including government departments. We just completed that training. I know the government does send out these warnings about spam. The IT group central within government sends out regular kinds of warnings about activities to avoid. That's certainly happening at the government level, but privacy awareness is a big issue and one that requires quite a bit of training.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Since I have a little time left, I would also like to talk about certain provinces that may not have a law covering a large number of government institutions or organizations.

I wonder whether some of you can comment on the possibility of expanding the Privacy Act so that it applies to crown corporations, for example, and to other public organizations subject to certain federal statutes. I want to know your opinion on that and to hear some examples, if possible.

I believe a large number of organizations in British Columbia are subject to the act. First I would like to hear the comments of the commissioner from that province. What organizations are subject to that act? Do they include crown corporations and businesses and all public and even para-public organizations?

[Drew McArthur]

As I noted in my opening comments, the oversight in the public sector in British Columbia extends to over 2,900 public bodies. Those include the central core operations of government, but they also include municipal governments, schools, crown corporations, hospitals, and municipal police forces. It has a pretty broad covering.

I will note that there is an area that is not covered currently, and we have made recommendations that it be amended. There are some organizations associated with public bodies. Typically they are associated with universities. They are companies that are created by universities, but they are not currently covered under the act, and we believe they should be. That's a gap in our law.

[Pierre-Luc Dusseault, NDP, Sherbrooke, QC]

Madam—

[The Chair, Conservative, Blaine Calkins]

Sorry, Mr. Dusseault, we're done, but we will get back to that.

For Ms. Tully and the folks from Newfoundland and Labrador, if you have some comments on that, I'm sure you'll have an opportunity to have input on that.

Mr. Saini, go ahead for up to seven minutes, please.

[Raj Saini, Liberal, Kitchener Centre, ON]

First of all, thank you very much to all of you for being here.

The question I have is kind of unique, because all three of you practise under different models. B.C. has the order-making powers; Nova Scotia has recommendation powers; and Newfoundland has a hybrid model.

All of you act as privacy and information commissioners, and as you know, in the federal government, the office for information and the office for privacy are separate. In March, the Privacy Commissioner made a submission requesting the hybrid-model types of powers, and this committee, in its review of the Access to Information Act, recommended the order-making powers for the Information Commissioner. The Privacy Commissioner, having heard that the Information Commissioner got full order-making powers, also requested full order-making powers.

If you could just imagine both of your offices being split, how would you balance that? Do you think it's necessary that both the office of the information commissioner and the office of the privacy commissioner have the same powers, or should they be different? This question is to all of you.

[Donovan Molloy]

I think it's difficult to speak to the circumstances of the federal Privacy Commissioner.

In terms of our own experience, it would not be practical, because we have limited resources. Splitting the office would, I think, result in us being unable to fully effect our mandate under ATIPPA.

The model we have, whereby we make a recommendation that can become an order if it's not appealed to the court within 10 days, is very effective. It places the burden on the public body. It also allows us to participate in the court hearing, which is invaluable, because we get to give our own objective perspective in court. Sometimes in the case of a person who doesn't have the resources to have their own counsel, that is really the only substantive quality argument the court hears, other than the arguments that are filed on behalf of the public body.

[Catherine Tully]

If I understood your question correctly, if I imagine my office split so that there's access and there's privacy, your question is whether they have the same oversight authorities.

[Raj Saini, Liberal, Kitchener Centre, ON]

Yes.

[Catherine Tully]

My view very strongly at the federal level, having been there, and thinking of it in the Nova Scotia context, is that the two offices are regulating the same entities. I would think it would be very important that they have the same authorities, either order-making or not, because day to day you're dealing with these two oversight agencies. I think it would undermine the authority of one if the other had order-making authority and it didn't, so I can see the practical reasons why they should be the same. Certainly, from my perspective as an oversight agency, I would want consistency across those two roles.

[Drew McArthur]

Our experience in B.C., of course, is having access to information and protection of privacy in a single statute with the order-making powers.

I can't tell you what it would be like to have two separate agencies, but in our case we have a holistic view of the operations of government from both perspectives and we can ensure that the appropriate recommendations are made, and in the case when we need it, we have the ability to implement orders.