Information & Ethics Committee on Nov. 24th, 2016

[The Chair, Conservative, Blaine Calkins]

Good morning, colleagues. We are very pleased to be wrapping up our study on the Privacy Act today.

We have waited to the end to invite the ministers responsible for the legislation we've been reviewing. We're very fortunate to have with us today Minister Brison, the President of the Treasury Board, Minister Wilson-Raybould, our justice minister, and with them, their staff: Ms. Dawson, Ms. Wright, and Ms. Khanna.

We appreciate your being here. You're slated to be here for the first hour Please help us in our deliberations and give us your insights.

Perhaps we have opening remarks from both of you for up to 10 minutes, and in the order I have on the agenda. If that's okay, we'll start with Minister Wilson-Raybould.

[Jody Wilson-Raybould, Liberal, Minister of Justice]

Thank you.

This is my first time before this committee, and it's a pleasure to be here this morning. I look forward to some discussion after we present our opening remarks. Thank you for welcoming my departmental officials.

As you know, and as you've been studying, the Privacy Act is a quasi-constitutional law that affects almost all activities of government. It has not been substantially reformed since it came into force in 1983.

You might approach Privacy Act reform by asking two questions. First, does the act contain the right principles for Canada in the 21st century? Second, does it feature the right rules and mechanisms to put them into effect? My remarks will focus on how we can move Canada forward in answering these two questions.

When we think about reforming the 1983 Privacy Act, our first instinct may be to focus on the impacts of changes in technology. Those changes can seem dizzying. Big data finds unprecedented ways of harnessing information. The Internet of things promises to cover human environments in a web of coordinated sensors and processors. The growth of artificial intelligence brings new ways of solving complex problems, and with quantum computing on the more distant horizon, there is the possibility that in our lifetime we will see an explosion of processing power with effects we can only dimly imagine.

Speculation about technology is exciting. It can also be scary. It might provide the push for law reform, but it does not provide the direction. Instead, I want to talk with you about two unchanging landmarks from which we can take our bearings for the review of the Privacy Act. They are trust and connection.

When you look at strong communities, democratic institutions, and functioning markets, one thing is clear. When people connect through relationships and networks based on trust, they can achieve great things, and great things should be in store for Canada. We are poised to be an open, secure, inclusive, prosperous, creative, and democratic information society. I am proud to be part of a government that is working on these goals.

To achieve them, Canadians need to connect with each other, with civil organizations, and with other democratic institutions. To connect, we need to be able to trust. When we connect with government online to seek information or a service, we need to be able to trust that the information we supply will be treated reasonably and respectfully, according to the law. We need to know that we can trust the connected systems that allow us to travel, communicate, enjoy safe food, and receive government benefits. We need to be able to trust that connecting with government will never make us vulnerable to manipulation or unjustified intrusions on our privacy.

Because ours is a democracy in which we collectively set rules for governments, we need to understand what governments do with information about us. The Privacy Act sets a basic framework for the protection of privacy in Canadians' relationships with government.

I agree with successive privacy commissioners, academics, organizations, parliamentarians, and Canadians who say that this basic framework in the Privacy Act is long overdue for a thorough review. That is why I have asked my officials in the Department of Justice to lead concentrated work, alongside other departments, towards modernizing the act.

The way I see it, privacy is not a drag on government institutions that are trying to achieve other important goals. Instead, privacy is a social good that makes all our collective projects better and more likely to succeed. Our government understands this.

The mandate letter handed to me by the Prime Minister asks me to ensure that our government's policy goals can be achieved with the least possible interference with the rights and privacy of Canadians. I will work closely with my colleague, the President of the Treasury Board, who is responsible for the way the act is implemented across government. I will also work closely with my other colleagues whose portfolios use personal information as they serve Canadians. I hope to continue what this committee has started by connecting with Canadians of all groups and generations as we review the Privacy Act.

In your study, I encourage you to tackle some of the tough questions, always focusing on connections based on trust. For example, how should the act, which was designed to be technologically neutral, take account of the changes in technology? How can the act also serve us amid global, federal, provincial, and territorial flows of information in the service of important Canadian projects? How could the principles in the act guide government innovations to find new ways to serve Canadians better?

I think these questions are worthy of your committee's study. Eminent witnesses have appeared before you, such as the Privacy Commissioner, professional organizations, officials from other jurisdictions, government representatives, and accomplished academics. You are well equipped to influence the government's review of the Privacy Act and to effect the development of the law.

I encourage you not only to make recommendations but also to state considerations, questions, and areas for further study. I very much look forward to the results of your deliberations and your excellent—I'm assuming—report that's going to come forward and inform the work I'm undertaking.

Thank you, Mr. Chair.

[The Chair, Conservative, Blaine Calkins]

Thank you, Madam Minister.

Mr. Brison.

[Scott Brison, Liberal, President of the Treasury Board]

Thank you, Mr. Chair.

I'm pleased to be back at your committee. I'm pleased to have with me today Joyce Murray, the Treasury Board parliamentary secretary, as well as Jennifer Dawson, the deputy chief information officer at Treasury Board.

The Privacy Act governs personal information-handling practices of government institutions. It applies to all the personal information we collect, use, and disclose about individuals or federal employees. It gives Canadians the right to access their personal information held by a government institution and gives them the right to request that the information be corrected if something is in fact inaccurate.

The Privacy Act, as my colleague, the Minister of Justice said, came into effect in 1983.

Since the 1980s, advances in technology have provided many new ways of collecting and using personal information. Protecting this information is something we take very seriously, and it’s our responsibility under the Privacy Act to do so.

As the justice minister pointed out, we know the act needs modernizing. Treasury Board, as the administrator of the act, will be working closely with the justice minister, who will be leading this review. We will look forward to your committee's work to provide recommendations on how we can, among other things, modernize the law for the digital age.

The Treasury Board oversees the administration of the act across government. The Minister of Justice plays an important role, as the Privacy Commissioner of course reports to Parliament through the justice minister. Our two departments work together to support about 240 government institutions that are subject to the act. I would like to take a moment to break down some of the key statistics around the administration of the Privacy Act.

Canadians submitted more than 67,000 requests for their own personal information in 2014-15. That has been increasing by about 4% per year since 1983. Seventy per cent of the personal information requests were responded to within 30 days. Another 11% were completed within the permitted 30-day extension.

In 2014-15, government institutions reported 206 material privacy breaches to Treasury Board or TBS. A material breach involves sensitive personal information and could reasonably be expected to cause injury or harm. The secretariat receives and reviews reports of material privacy breaches by federal institutions, and we support institutions in the follow-up to these breaches. In April 2016, I stated that the government will work with the Office of the Privacy Commissioner to improve breach reporting, and TBS is currently engaging with the office to strengthen reporting of material privacy breaches.

Also, within the secretariat, we set policies on how the act is to be administered, we provide support to government institutions as they carry out their responsibilities under the act, and we monitor their performance. We collect data from all government institutions and publish it in an annual statistical report on the administration of the act. This strengthens or contributes to accountability and transparency in how Canadians' personal information is protected and managed.

In my mandate letter, the Prime Minister asked me to ensure Canadians have easier access to their personal data.

In Budget 2016, we committed to two measures to do just that. First, we’re creating a simple, central website, where Canadians can submit requests for information about themselves to any government institution.

Secondly, we will not only make it easier to request personal information, but we will improve the speed of the government's response. There will be a 30-day guarantee for fulfilling such requests. If the response takes longer than 30 days, government institutions will have to provide the requester and the Privacy Commissioner with a written explanation for the delay, and we'll work with the Privacy Commissioner to develop new policy directions to implement this.

The fact is, we need to find the best ways to balance Canadians' need for better services with protecting their privacy. In closing, let me emphasize that balancing openness and transparency with protecting personal data is part of modernizing government in the digital age. We're continuously working to ensure that citizens' personal information held by government is well managed and that they have easy and timely access to it.

We are looking forward to working with parliamentarians and to your report. We are also looking forward to the justice minister's lead in terms of reforming the Privacy Act. During that period, we'll be working closely together to provide advice from the perspective of Treasury Board in terms of our role once that report is completed.

Thank you, Mr. Chair.

[The Chair, Conservative, Blaine Calkins]

Thank you, Minister Brison.

We'll now proceed to our rounds of questioning.

We'll start our seven-minute round with Mr. Saini, please.

[Raj Saini, Liberal, Kitchener Centre, ON]

Good morning, both of you. I warmly welcome you and your officials to this committee.

I want to start with a bit of a broad question. One of the things you've both mentioned in your opening statements is about how important it is to modernize the act, but I also think there's an element of efficiency we should have when creating new policies, so I have just a general question, and maybe I can get your comments.

Do you see any value in having government departments consult at the outset of that policy-making process with the Privacy Commissioner regarding any policies that will affect the privacy of Canadians, as compared to at the end, when the Privacy Commissioner may be brought in to audit the policy? It's about working in concert from the outset to make sure there are no problems, that everything is smoothed over, and that there's an efficiency process, as opposed to the commissioner coming in at the end, once the policy has been drafted, and then having to audit that policy and make changes afterwards.

[Jody Wilson-Raybould, Liberal, Vancouver Granville, BC]

Maybe I can speak to that initially.

In terms of looking at the Privacy Act and in terms of potential law reform, I see great value in engaging with a whole host of individuals, including the Privacy Commissioner. I have had the opportunity to meet with him already on a number of occasions. I see value in continuing to do that throughout the course of our studies and investigations into what potentially could be most appropriate in terms of reform.

Likewise, I see tremendous value in receiving the report from this committee. We'll consider that in depth. As I said, I've already instructed my officials to start to do substantive studies around potential areas of law reform, and then further, at the end, included within this process, to do a substantive review of the Privacy Act as it is right now with an eye to modernization, to ensure that we engage with Canadians. It's my intention to do so in a substantive way.

[Scott Brison, Liberal, Kings—Hants, NS]

I think the idea of doing privacy impact assessments on any new initiative makes a lot of sense. I know that the commissioner is interested in that approach. We would recommend to any government department or agency that they take him up on that, in the same way that a government department or agency, in considering something, can check in with other commissioners, including access to information or the Information Commissioner, as an example.

I think it's far better from a governmental perspective and from a citizen's perspective that we take into account their advice pre-emptively, as part of the implementation or development of a new policy, than in the form of a report that is usually pointing out what went wrong. It would make more sense, because this this is what they do every day. They are experts in these areas. The Privacy Commissioner has a lot of expertise within his shop, so it commends itself to me, the recommendation he has made, that we would engage him as part of the process of developing policy.

[Raj Saini, Liberal, Kitchener Centre, ON]

The second question I have is on the public education mandate. I think the Privacy Commissioner has also spoken about the fact that maybe he should have a greater ability to provide information to Canadians and to explain to them exactly what their privacy rights are. Do you think that should be encouraged in the powers he has, in the powers of the office, to make sure that Canadians understand what their privacy rights are and what the limitations or advantages are?

[Scott Brison, Liberal, Kings—Hants, NS]

Jody will want to add to this, but one of the things we have in the digital age is the ability as a government to disseminate information broadly to Canadians much more easily than at any time in our history. The ability for us to put that information out there so that Canadians can understand their privacy rights and the policies that protect them is there. It makes sense that we communicate that transparently. That makes a great deal of sense to me.

[Jody Wilson-Raybould, Liberal, Vancouver Granville, BC]

I will underscore what my colleague has said. I think the role that the Privacy Commissioner can play in and around education is incredibly important. I believe that one of the recommendations was to bolster that education role so that individuals can have a substantive understanding with respect to their rights and as they relate to our institutions of government. I think it's an important role that should be considered in a concrete way.

[Raj Saini, Liberal, Kitchener Centre, ON]

There's one final question I wanted to ask. As you know, part of the debate during the study we did on access to information, and which is currently ongoing, is to decide what powers we should give to the commissioners, whether it be the Information Commissioner or the Privacy Commissioner. Do you think each office should have the same powers? Or should there be a separation whereby one may get full order-making powers and another might use the hybrid model? Do you think it's advantageous to give them both? Or should there be a difference in the powers of each office?

[Jody Wilson-Raybould, Liberal, Vancouver Granville, BC]

My colleague can speak to considerations with respect to the Information Commissioner, but again, I do recognize some of the recommendations that the Privacy Commissioner has put forward, certainly on the importance of the role that he plays in and around education and the international work he undertakes in terms of reviewing what's happening in other jurisdictions. Having said that, I again recognize that he has made some recommendations in terms of additional powers.

I certainly am open to your deliberations and considerations therein. A movement toward additional enforcement powers for the commissioner would be a fairly dramatic change in terms of the legislation, but it's not one that certainly wouldn't be something to consider as you deliberate and study. Certainly, my officials are looking at that as well.

[Scott Brison, Liberal, Kings—Hants, NS]

My understanding—and, of course, the justice minister will be leading the reform of the Privacy Act—is that in March I think the Privacy Commissioner recommended improving the ombudsman model. He mentioned the Newfoundland and Labrador model, I think, at that time, and in September, I think he spoke of an order-making power. This is something that I hope you as a committee, in your deliberations and in your report, will take a look at the models—

[Raj Saini, Liberal, Kitchener Centre, ON]

I think he made that comment based on the fact that the Information Commissioner wanted full order-making powers.

[Scott Brison, Liberal, Kings—Hants, NS]

Okay.

[Raj Saini, Liberal, Kitchener Centre, ON]

That was in response to some of the commentary she made.

[Scott Brison, Liberal, Kings—Hants, NS]

I look forward to your report.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

Moving on, our next questioner is Mr. Jeneroux, please, for seven minutes.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Thank you very much.

Thanks to you and to your staff for preparing for today. I really appreciate your coming before us.

I can't help myself, Minister Brison. With some of that logic, you would think that you would contact the Ethics Commissioner before you would have a type of fundraiser—or perhaps not. But I promised that I wasn't going to get too partisan today, so I'll just leave that to linger out there, if you will.

I want to talk about some of the comments you made here earlier. You said that 67,000 people have requested their information, and that has been increasing by 4.5% per year. In one of the recommendations from some of the witnesses we've heard from, they've suggested opening this up to outside of Canada. I'm hoping that we can get some of your thoughts on that, particularly based on the 70% of people who are seeing the 30-day commitment right now.

[Scott Brison, Liberal, Kings—Hants, NS]

I think the justice minister will have something to say on this, but the primary function would be to serve our citizens. Improving the efficacy of our service to our citizens, wherever they live in the world, I think ought to be the primary function. I think we can make significant improvements before we open up to anyone anywhere in the world.

That's my instinct on this, Matt, so that's where I would focus initially. Strengthening our response times, both in the quality and the timeliness of our response to Canadian citizens, would be the focus. That's my instinct.

Jody.

[Jody Wilson-Raybould, Liberal, Vancouver Granville, BC]

Thank you for that question.

I agree with my colleague. Universal access is something that has been discussed, and recommendations have been made. Certainly, there's the general principle—and I acknowledge the general principle—that individuals should be able to understand and know what information government institutions have on them, subject to some strict exceptions. From my understanding, in terms of the discussion that has been had around this, there is a resource consideration that needs to be taken into account. We would be very open to and welcoming of the feedback you might have in this regard.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Thank you.

There's a question I struggle with, and that I've struggled with here: how much do we put into the act in terms of the technology advancements we're seeing? It comes down to the “we don't know what we don't know” argument.

I'm curious as to your thoughts on this, both of you. Do we take a specific path and say that this type of technology is what we're going to cover, or do we leave it broad and open to interpretation and perhaps put some of that into the policy around it?

[Scott Brison, Liberal, Kings—Hants, NS]

It's a good question.

Jody.

[Jody Wilson-Raybould, Liberal, Vancouver Granville, BC]

It definitely is a good question. In my opening remarks, I was speaking about how quickly technology advances. This is certainly something that you could delve into more deeply and have a discussion on. We would welcome that discussion from this committee. As introduced back in 1983, the Privacy Act was intended to be technologically neutral so as to account for the rapid changes that occur over time, with the Privacy Act setting the broad framework for the relationship between government institutions and individuals concerning their information.

Again, we'd be very open to and welcoming of any suggestions or guidance in that regard.