Evidence of meeting #27 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was personal.
A recording is available from Parliament.
12:25 p.m.
NDP
Pierre-Luc Dusseault NDP Sherbrooke, QC
Not a problem. There's no way to be familiar with the details of each of the 3,000 requests made.
12:25 p.m.
Director, Access to Information and Privacy, Canada Revenue Agency
Indeed.
12:25 p.m.
NDP
Pierre-Luc Dusseault NDP Sherbrooke, QC
It would still be useful for the committee to obtain that information.
12:25 p.m.
Director, Access to Information and Privacy, Canada Revenue Agency
Certainly.
12:25 p.m.
NDP
Pierre-Luc Dusseault NDP Sherbrooke, QC
I have one last question to ask, Mr. Chair.
One case concerning data management subcontracting was reported. The Privacy Commissioner investigated a matter involving Shred-it, a company that stores data, presumably in paper format. There's a large volume of paper documents at the Canada Revenue Agency, because it retains certain information for dozens of years.
Do you take additional measures in the case of a subcontractor or a private company that manages Canadian taxpayer data? Who don't you look after this internally? Why isn't it managed by your department? Why subcontract when the department could do it directly?
12:25 p.m.
Director, Access to Information and Privacy, Canada Revenue Agency
I couldn't say why we subcontract rather than doing it internally. However, I can say that a process has been established so that firms—I forget the exact term but it pertains to contracts—meet our requirements, and do everything we want in terms of privacy.
You referred to the Privacy Commissioner's report. We contacted the Commissioner and we met with him a few times during this process, to explain what we were expecting from the company at the time. The complaint filed with the Privacy Commissioner was about the fact the information was managed by a company located in the United States. Ultimately, the Commissioner conducted an investigation and verified certain things. He concluded that the complaint was not well-founded.
12:30 p.m.
NDP
Pierre-Luc Dusseault NDP Sherbrooke, QC
That was the Commissioner's finding.
Who would be able to answer the question about the policy allowing for the use of subcontractors for data storage? Is this more of a policy decision?
12:30 p.m.
Assistant Commissioner and Chief Privacy Officer, Public Affairs Branch, Canada Revenue Agency
No, I don't think so. If I understand correctly, it's purely for operational reasons.
I'd like to clarify that all the documents are paper documents, handled by a company called Recall. I can do some checking and get back to you with a more detailed answer on the subject.
My understanding is that the Agency uses subcontracting so it can realize economies of scale. The Agency has more than 100 sites in Canada where documents can be retained. The retention of all these documents within a single organization calls for rather impressive record management technology, and the documents must be locatable in boxes using bar codes. Rather than invest in these kinds of technologies in its numerous centres, I suspect the agency uses subcontracting primarily for efficiency and economies of scale.
12:30 p.m.
Director, Access to Information and Privacy, Canada Revenue Agency
Mr. Chair, may I add something on this subject?
12:30 p.m.
Director, Access to Information and Privacy, Canada Revenue Agency
I'd like to add something to what Mr. Guénette has just said.
Before we opted to use the services of that company, the document management was done by Library and Archives Canada. It never really gave up that function. It's simply that it's not necessarily part of its new mandate. So we had to find a solution to ensure that document management continued. Prior to this, it was done internally by the government.
12:30 p.m.
Liberal
12:30 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Thank you, Mr. Chair.
Commissioner Therrien had initially recommended something short of having order-making power, but he recently changed his recommendation to indeed ask that his office be given order-making power and go to that model of office.
I'd like, Ms. McCulloch and Mr. Guénette, for you each to comment on how you think that will impact your organizations.
12:30 p.m.
Director, Access to Information and Privacy, Shared Services Canada
My expectation, given years of working with the commissioner's office, is that the approach will likely continue to be one of an ombudsman, as the ultimate goal for the commissioner's office, as well as the institution, is to resolve the matter as quickly as possible and to the complainant's satisfaction. I would expect that the cases where orders must be issued will be few and far between, and I don't think it will have a huge impact.
It will be handled very similarly to current situations, where, if the commissioners were previously recommending a particular resolution to a complaint, the matter would be dealt with at a very senior level of the organization. But those are limited cases, whereas the majority of matters are normally resolved at an operational level, so I don't expect a huge impact on that end.
The government will always have the opportunity to go before the court should there be a real difference of opinion from a risk perspective. If we receive an order to release records, where we feel it would have a grave invasion of privacy, or we feel there's a public interest that outweighs the invasion of privacy, the matter could be taken to the next level of review, but it should be in very limited cases.
12:35 p.m.
Assistant Commissioner and Chief Privacy Officer, Public Affairs Branch, Canada Revenue Agency
Thanks for the question.
Very similarly to Ms. McCulloch, I would think we approach our dealings with the Privacy Commissioner with the intention to find common ground, and if we enter a different legislative framework where there is an order, we would attempt to resolve the situation before it comes to that.
In terms of what that particular change might imply for our work, it's hard to speculate on what that might look like, without knowing more of the specifics of how that would roll out. Certainly with a place like CRA, with the volume that we're dealing with, depending on how this gets rolled out, there may be an impact in terms of our processes and our resources, which we would need to address, but we would comply with whatever framework is put in place by the government.
Yes, I think I would agree with Ms. McCulloch that the attempt is to find common ground, and then, for the most part, we are successful in doing that.
12:35 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Do you agree with the recommendation to go to an order-making model?
Some critics in our study of access to information have argued that when you have order-making power, you cease to become an ombudsman and you become an adjudicator. Instead of being an advocate for privacy, you become a person who makes a judgment about a particular case, rather than just advocating for privacy.
Do you share those concerns, or do you believe that the order-making model is the correct way to go with privacy?
12:35 p.m.
Assistant Commissioner and Chief Privacy Officer, Public Affairs Branch, Canada Revenue Agency
I would hesitate to express an opinion as to whether or not that's the right way to go. I think my role with the agency would be to implement whatever decision gets made in terms of the legislation. Certainly, as I said, with or without this order power, our attempt is to comply with the letter and the spirit of the act to the extent possible, and we would do that under either framework.
12:35 p.m.
Liberal
The Vice-Chair Liberal Joël Lightbound
Thank you very much, Mr. Kelly.
I now give the floor to Mr. Long.
12:35 p.m.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Chair.
Ms. Bernier, in another article I read, you gave some comments about the anti-spam legislation. Obviously, there are businesses and marketers that think it's restrictive, and then obviously from an individual standpoint, I understand it's there to protect us from being bombarded with too much.
Can you just give me your comments? Do you think there's a balance there, or do you think the legislation is strong enough?
12:35 p.m.
Counsel, Privacy and Cybersecurity, Dentons Canada
First of all, I conclude that I write too much. Really.
CASL is a completely different subject, and as you know, very controversial in industry. On the other hand, the Office of the Privacy Commissioner has issued its first investigation into CASL this summer, and I believe that consumers will be happy to see the restrictions that have been put on industry.
To answer your question of whether it hits the right balance, I would suggest we wait a few more years. What I mean by that is that we should accumulate more experience on how business feels that it responds to a genuine desire for promotional ads or information and their own needs.
There is consent. You can obtain the right to get promotional information, and in fact the comparison that Mr. Saini made a moment ago about opting in and opting out, this is under the Privacy Act but is an architecture of control that can allow the sending of promotional—therefore commercial—economic messages to a consenting recipient and to make a definition that you want everything or you don't want everything. There we can find a proper balance between the rights of the consumer not to be bombarded, as you say, and the needs or the desire of the organization to help its marketing initiatives through that.
12:40 p.m.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
How concerned should we be about consumer apps demanding too much permission? I don't know if it was your office, but one of the Privacy Commissioners' offices did a sweep. I think it was of 1,211 apps where 75% of them requested either location, access to ID, camera, or contacts. How concerned should we be about that?
12:40 p.m.
Counsel, Privacy and Cybersecurity, Dentons Canada
We should be quite concerned, but the good thing is that we are and the Office of the Privacy Commissioner survey of January 2015 showed that Canadians are not only appropriately concerned but they're actually taking action and will now, more and more, refuse to download apps that are overly intrusive. I think the awareness is now giving rise to action, and that's the way to vote. We vote with our fingers, I suppose in this case. You don't press send. You do not send them their information. You do not download.
We need to be aware of that, and we need to make sure we hold the app developers and the companies to account to minimize the information they seek through the apps, or as you were referring to a moment ago, Mr. Saini, if they do want to collect a lot of information because they want to do business intelligence, because they want to tailor their services to you, then they need to have specific consent for that.