Information & Ethics Committee on Nov. 1st, 2016

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Are you recommending then, in a case where, say, there is a complaint after the fact and you find that there's a breach, that there be any kind of consequence for that breach? What do you think should be the outcome of your finding in a case where it's shown that this agreement, if there is a written agreement, wasn't followed properly?

[Daniel Therrien]

That's a good question.

At a minimum we would find that the transaction was not in accordance with privacy law. To the extent that it's not too late to remedy the situation, one could think about how to frame the order making to provide for that situation. I don't have a precise recommendation to make, but it may be that it's too late. If it's too late, our position would govern the future. We would acknowledge, would say to the department, “This was inconsistent with privacy law; you should govern yourself accordingly.”

Theoretically, you could think in terms of damages or things like that. I'd rather try to determine whether it is too late to remedy the situation. If it's too late, I would not jump to the issue of damages. I would try to find other remedies to protect the person in the situation before the transaction, which was inconsistent with privacy law.

[The Vice-Chair, Liberal, Joël Lightbound]

Thank you, Mr. Blaikie.

We'll now move to Mr. Erskine-Smith for seven minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Perfect. Thanks very much.

I'd like to start with your recommendation to create an explicit necessity requirement for collection. Privacy is a quasi-constitutional right. There are always two legs to a constitutional analysis. It's not just necessity; it's also proportionality. Some witnesses testified at this committee that we should impose that requirement as well, and it should be a dual requirement. I wonder if you have thoughts that we should not only make it necessary but make it proportionate.

[Daniel Therrien]

We say that the statutory standard should be necessity, but we also recommend that you consider defining necessity. In our recommendation we define necessity, in part, through proportionality. At the end of the day, both necessity and proportionality would be part of the standard.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

That requirement would be for collection. In answer to my friend's question, you had mentioned it's just for collection, but not for information sharing.

I want to talk about three different things: collection, that's pretty clear; there is also information sharing; and then there's the retention of that information and the timelines for retention. When we get to information sharing, if it's not a necessity condition or standard, we heard from some witnesses that it could be a compatible use standard, it could be a consistent use standard. What standard are we talking about? Surely there should be some condition. It shouldn't just be through ad hoc agreements.

[Daniel Therrien]

The current act already does have a number of standards, so consistency where it applies and then other standards in other situations. For instance, one of the provisions that authorizes information sharing is in court proceedings in order to respond to a subpoena. There's no gradation here. Either you respond to the subpoena, or you don't.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm sorry to jump in, but those are specific cases and surely different standards might depart from them, so if we have a necessity requirement for collection, great. We could have another requirement generally speaking and it could be departed from in specific instances, as outlined in the act. But why would we not impose a necessity requirement for information sharing if we're imposing it for collection, at least in the first instance?

[Daniel Therrien]

In an information-sharing context, there are two parties. There is a sending institution and there is a recipient institution. For the recipient institution, the information-sharing transaction is actually a collection exercise, so necessity may not apply to the sending institution, but it applies to the recipient institution.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

In fact, necessity, then, is fundamentally for the receiving institution. The collecting institution will govern information sharing fundamentally.

[Daniel Therrien]

Yes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Great.

When it comes to retention of information, should we also impose a necessity requirement?

[Daniel Therrien]

I will say yes. Certainly, retention at the level of principles should be governed by.... Yes, the necessity to keep that information for a lawful government program, that should ultimately be the test.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Perfect. Thanks very much.

Your previous recommendation had been to allow complainants to apply for review by a Federal Court, that the court be able to award remedies including damage awards. A full array of remedies, I think, was the language used.

When I look at the recommendations now, do I take it that the recommendations consider creating a statutory mechanism to independently review privacy complaints against the OPC? Is that part of it, or has that recommendation gone?

[Daniel Therrien]

There are two things. To deal with the easier question first on the privacy ad hoc mechanism, in 2007 the OPC became subject to the access provisions of the Privacy Act and the Access to Information Act. We had to provide information, as departments, which then led to, if according to an individual we do not act in a way consistent with this legislation, who do people complain to?

In a Privacy Act scenario, we cannot be party and tribunal at the same time, so we created this mechanism. In a case called Oleynik, which is a few weeks old, the Federal Court heard arguments as to whether there should be a statutory basis for that mechanism. They suggested this was not something the court should look at, but that Parliament should look at. That's one thing.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Bracketing that and then moving to the courts as the arbiters for damage awards and a full array of remedies, has that been removed from your set of recommendations?

[Daniel Therrien]

Yes, essentially on the basis that here we're dealing with.... Tribunals federally are subject to judicial review, as you know. There is a special remedy in the Privacy Act, which is a de novo review of an access request. That's a current remedy in the act.

Why was that remedy created? We think it was created to provide a readily accessible remedy to individuals in cases where the OPC may recommend that a department disclose information but the department does not, so there needs to be an easily accessible remedy for the individual.

If the OPC has order-making powers, our position is that the need for this remedy, the Federal Court de novo review, may no longer be there because we would be the readily accessible remedy for individuals to have access. We're actually even more accessible, and perhaps quicker, than the Federal Court de novo review.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Assuming the powers don't include the power to award damages, would it not still be required that an individual should seek remedies from a Federal Court?

[Daniel Therrien]

In our submission, then, if there were a charter violation, there would be damages according to section 24 of the charter, but otherwise not.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

My last question is on order-making powers. You had originally asked for a hybrid, and you've been clear that you're now asking for order-making powers. Without having tested systems at the federal level with the Information Commissioner and the Privacy Commissioner, do you think there is any merit in giving the Privacy Commissioner hybrid powers, or in seeing how a hybrid system plays out, so that we could learn from both systems in our five-year review?

[Daniel Therrien]

The short answer is no. What I think we should all try to achieve is a mechanism that provides a quick, final decision to individuals who seek access or privacy rights, together with a system that is sustainable. As to arguments around whether the hybrid model creates risks of conflicts of interest and so on, I think such arguments would simply delay things, creating judicial debates that are not necessary. I would rather deal with the issue head-on and have order-making powers.

[The Vice-Chair, Liberal, Joël Lightbound]

Thank you.

We'll now move to Mr. Kelly.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

Your recommendation number 13 asked for discretion to discontinue or decline complaints in specified circumstances. The recommendation mentions specifically frivolous, vexatious, or complaints made in bad faith, but it also talks about specified grounds that include those categories. Are there are other grounds you think would be appropriate, to be able to have discretion for discontinuance?

[Daniel Therrien]

I'll give you a few and I'll ask my colleague Patricia Kosseim to complete the list.

We say “including” because this kind of discretion exists under PIPEDA. We can manage our work volume, essentially, by refusing to handle certain complaints on various grounds, including if a complaint is frivolous or vexatious. There are, however, other grounds in PIPEDA. For instance, is there another effective remedy available to the individual, other than to make a complaint to the Privacy Commissioner? Is the commissioner seized of another complaint that raises the same issue? In order to be efficient, you look at one complaint, not a number of complaints. These are two of the grounds in PIPEDA.

Madam Kosseim will complete the list.

[Patricia Kosseim, Senior General Counsel and Director General, Legal Services, Policy, Research and Technology Analysis Branch, Office of the Privacy Commissioner of Canada]

Other grounds that exist currently and with which we work in respect of the private sector include where there's insufficient evidence to pursue the investigation, perhaps due to timeliness and the disappearance of relevance; where the organization itself—in this case, a department or an institution—has already provided a fair and reasonable response to the individual; or where the matter has already been the subject of a report by the commissioner and a recurring issue has already been dealt with. Those are some of the additional examples.