Information & Ethics Committee on Oct. 6th, 2016

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Thank you.

Ms. Bernier, I believe you said early on that you looked favourably on the recommendations. I don't know if you're able to carefully analyze the whole report, but let me ask you a specific question. In recommendation 15, the Privacy Commissioner suggests amending the act to extend coverage to all government institutions, including ministers' offices and the Prime Minister's office. What would you see in that recommendation?

[Chantal Bernier]

As I've mentioned to Mr. Dusseault, I see this favourably, because we have a legal void at the moment in this regard. In other words, there is personal information held or could be held in these offices that is not currently protected. When you look at the fact that the government in power, the ministers, the Prime Minister, do exercise the powers of government, they should be held to the standards of the Privacy Act to collect, use, or disclose that information.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

In recommendation 11, the suggestion is amending section 64 to allow the commissioner to report publicly on government privacy issues where he considers it in the public interest to do so. The Privacy Commissioner already has the power to issue special reports and annual reports and so on. Is the expansion of this useful in your view?

[Chantal Bernier]

It is, absolutely. I was confronted with this when we finished the investigation of, as it was then, Employment and Social Development Canada. You will recall that it lost a hard drive of 583,000 Canadians' financial information. It was just too big, I felt, to leave it to the annual report. I thought that the Canadian public deserved a quicker result of our investigation, and therefore, proceeded by tabling a special report.

But it is quite stilted and onerous. It is demonstrating a lack of flexibility. I was wanting to serve the Canadian public well by stating the results of our investigation, but I could only do it through the special report procedure.

I believe that this recommendation is very cohesive in the transparency theme of the commissioner's recommendations.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

How do you see it working in the case of some major breach or something? Would the Privacy Commissioner advise the government that he intended to speak to that, or just how do you see that working?

[Chantal Bernier]

As I mentioned when I described the status of the Privacy Commissioner as an agent of Parliament, he does not need to inform government. He just goes out and says this is what he has discovered and this is what he is reporting on. The way it is done, it would be at the end of an investigation, or it could be as we did for ESDC.

When the news came out, I immediately announced that I was initiating a complaint, because the commissioner can either initiate the complaint or reply to complaints filed by a plaintiff or many complainants. This was really too big not to do something about it, so I chose to initiate a complaint. Then I chose to publish the report outside of the annual report, but the artificiality of that constrain I had, which meant I had to do a special report, was really not justified. It really was a hindrance to transparency, for no use.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Is there anything in the review that leapt out as missing, that you thought might be addressed in the recommendations?

[Chantal Bernier]

The departure I would make is the one I have underlined, and that relates to the recommendation on necessity. That's recommendation 4, where the Privacy Commissioner says that it should be proven to be necessary to the program or government activity. I believe that inherent test is not sufficient. It should be an external test grounded in the charter.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Yes. Those are good comments. Thank you.

[The Vice-Chair, Liberal, Joël Lightbound]

Thank you, Mr. Bratina.

We still have Madam Dzerowicz and Mr. Saini who would like to ask a few questions. I'd ask you to keep it relatively short because we have about 10 minutes left.

We'll start with you, Madam Dzerowicz.

[Julie Dzerowicz, Liberal, Davenport, ON]

Thank you very much.

I know that the Privacy Act is different from PIPEDA. Google collects a lot of information on me. Should there be a better relationship between the two, PIPEDA and the Privacy Act? That's a general question.

The second thing is that technology changes fairly quickly now. How do we keep our legislation sort of agile and ongoing?

Then I have another question for Ms. McCulloch and Mr. Guénette.

[Chantal Bernier]

How relevant.

First of all, just to put it in perspective, Europe does not have separate legislation for private and public sectors, and I have often questioned in my mind whether we should. But we do and we have an excellent system. The reason we do is easily justified by the difference in legal paradigms that are the subset of both. This, again, goes back to my answer to Ms. Rempel, meaning one is the state-to-citizen relationship Privacy Act and that is grounded strictly in necessity. The state cannot intrude upon your privacy unless it is demonstrably justified in a free and democratic society.

The relationship you have with other data holders, say Google, Facebook, or any company you buy something from, is predicated on your relationship, your free relationship with them, and therefore is built on consent.

I think that the way we have it constructed is working very well. However, the bridge that you're pointing to is extremely important and increasing. We've seen it with what is often referred to as the deputization of the private sector. Obviously, the big showdown of Apple and the FBI is an example of that in the U.S., where you have this treasure trove of information in the private sector that the law enforcement agencies, therefore the public sector, wants to have access to. How do we regulate that connection?

There has been clarification in Canada. One clarification was, as I mentioned earlier on, R. v. Spencer. A more recent clarification that goes more directly to your question is in R. v. Rogers Communications Partnership. That was January 2016, where the issue at hand was a judicial warrant for a tower dump, a tower dump being giving to the police all of the exchanges, communications, within the vicinity of a specific cellphone tower, which would have resulted in providing the police with 43,000 people's exchanges between, say 3:00 and 5:00 on that day. Why? Because there had been a jewellery robbery at that time on that day. Rogers said, no, opposed the warrant, and the police stood down. However, Rogers still went to court and said that warrant was invalid because it was overly broad. The police replied via the Auditor General that Rogers had no standing in fighting this issue, whereas the court—and this is very important to your question—said not only was Rogers right in refusing to comply with a judicial warrant because a judicial warrant was too broad to be constitutional, but it had the obligation to oppose the warrant as its contractual duty to its customers.

That really illustrates, I believe, the link you're making between public and private.

[The Vice-Chair, Liberal, Joël Lightbound]

It will be Mr. Saini now for three minutes.

[Raj Saini, Liberal, Kitchener Centre, ON]

I have one final question, Madam Bernier. You raised an interesting point that I found very curious. You talked about how Dentons is worldwide. Obviously if you have worldwide offices, you have different privacy regimes in different jurisdictions. Because whenever you have a regime in any country there's an application of resources whether they be human or financial, if you have clients who are doing business in multiple jurisdictions, how do you equilibrate all of that to have one standard?

Are there multiple standards, or do you devolve to the jurisdiction where the business is occurring or where the case is being tried or heard? How to you equilibrate all that?

[Chantal Bernier]

We have to follow the law everywhere we operate, and the law is different in different countries.

I was in our Singapore office recently and we were discussing, specifically, how you regulate privacy law in Singapore, but in that case, it was a Canadian business going there. The jurisdictional rules around privacy law are such that where the operation takes place, where the information is collected, must always correspond to the laws of the country where it is collected.

However, there are different laws for cross-border. There are countries that do not allow the cross-border transfer of personal information from their citizens, except with very tight rules, conditions, and so on. There are other countries who are mainly requiring due diligence, saying you can go cross-border but make sure that through the transfer you protect the information at the same level as, say, Canadian law requires you to. They do that by, first, choosing very trustworthy contractors, and second, by having contractual clauses that specify, the contractor will protect the information at the level they, the customer who's using the contractor to transfer the information, are held to and that they will audit and inspect the contractor. There are compliance measures like that.

Yes, it is definitely a conflict of laws challenge, but one that is governed by rules of conflicts of laws.

[The Vice-Chair, Liberal, Joël Lightbound]

Thank you very much. I would have had some questions for Madame Bernier, but I guess we'll have to reinvite you. It was with a sense of sacrifice, as I chaired, that I didn't get to ask my questions, but some other time.

Thank you all for being with us today. It was greatly appreciated, and I want to wish all members a happy Thanksgiving. We'll see each other again in two weeks.

Thank you, everyone, and have a good day.

The meeting is adjourned.